{ "Event": { "published": true, "date": "2021-10-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-05", "timestamp": 1633478581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4902597d-e2aa-4b72-9a50-aa203f0ef2ef", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd964ea-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633411624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411624, "uuid": "535afa6f-56ae-4ab3-a646-df492f9136f0", "comment": "Malware payload (Formbook)", "value": "e85d13e5ce7a9ef61f74b36e4406386a", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411624, "uuid": "899ca2cf-be43-47ea-a597-d59100e88dce", "comment": "Malware payload (Formbook)", "value": "00557f1996ecaac2e1a0458b692543493c940b3ea0925c106e6dbcb856f8e9e6", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411624, "uuid": "8b2d4394-9165-487d-94bd-21f8ecb99ddc", "comment": "Malware payload (Formbook)", "value": "b4d9786055d4e4b8f6524d0b6650eb95233c3e39", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411624, "uuid": "131b5563-f07b-437e-9e4e-0ac11548abf8", "comment": "Malware payload (Formbook)", "value": "87a5b25d2be79fe617a6306f0e613fa9bff61917badca0d3a7513eb4f6af93b0cab200605805da9511bbf44f65046dd6", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411624, "uuid": "e8ac2398-7413-4fbf-9048-858a2ffb4681", "value": "T182E4CF64B743D507CE754BB028ADE6405339BF211649C31E3989B7BD2E737702A8CADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411624, "uuid": "622f5a1e-3840-4ae3-b3ad-6f837895c421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411624, "uuid": "4ae713cd-ea40-402f-a4fa-612fcc78f9fc", "value": "6144:yymygZ6W+Q+3HwOExxrDvZhP6xUgu88wnb0jpv38wdeSp1WEXvuAcSOQLdKJZvwm:Hg3oODvZRBg3Nspv/2PvQLdKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411624, "uuid": "32e5d065-d597-4524-bf3b-d562cbdd197f", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411624, "uuid": "edd838b0-d844-48db-8ae9-bf00242ea74a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411624, "uuid": "857a9963-eab1-4b07-aff5-fe3919ed4c07", "value": "Copia de pago_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a207031c-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633417103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417103, "uuid": "96df9684-8d0a-42a8-a994-d5a0efab38e7", "comment": "Malware payload (GuLoader)", "value": "d769d693f32d17b8f802647844e4f395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417103, "uuid": "97890d53-711a-41b5-acce-fa9d1af4c84f", "comment": "Malware payload (GuLoader)", "value": "00a269bbcd4dd37d9d66e7f98b094511528358d8ad45b2ce92155455a30f810b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417103, "uuid": "b7efd24f-a7ef-4f1a-87c4-386ee7afa7c6", "comment": "Malware payload (GuLoader)", "value": "a6d06482a239003525ce473a3380ac78afe43281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417103, "uuid": "c9bb4381-8b18-4b2f-a9cd-f49d86821b66", "comment": "Malware payload (GuLoader)", "value": "91dfeb145e6adb6775f3326f37d08d89c110e431dcaeb8be8b4305a73edda31aeeddff2eb778d6fe42a18040ee711fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417103, "uuid": "aff9ae2b-abe2-476b-b376-7cf0005c3512", "value": "T166A3B132EA90DBE5F960D2FDB731F0F604E2AC66C9910A1735843F0574F61CA69F0A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417103, "uuid": "6a83a5d8-c9e8-48af-b687-f63fd699d6cc", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417103, "uuid": "feaf001e-c473-4e4d-9e62-e22f2f3b1822", "value": "768:tRFDRYh7WakW2AS/q9YB85ncKIF2b5fn2foar7t3IfpTF4BxHogoneGf7/gztUnN:tTVKCPWH9a8aKIF8nCPd3Wxmjon2oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417103, "uuid": "33541a2e-8d1e-4fed-b65c-6fbf6b118777", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417103, "uuid": "d4499fa7-d01c-4ede-b240-0fb0a3633eeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417103, "uuid": "fe1d4905-8a69-4e60-8c34-762ef39d5d4f", "value": "Sipari\u015f-05.10..2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccb8e4e-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633440690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440690, "uuid": "bc309ed8-eeb5-4ba7-a240-faa788031882", "comment": "Malware payload (AveMariaRAT)", "value": "ba089fe4546d19803adad582ca6f2ec5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440690, "uuid": "a12f224c-5675-49cb-a832-a2c06237df71", "comment": "Malware payload (AveMariaRAT)", "value": "014cd6b5ea8a3b792f7f8926eab05f857fa548a5c75bb6a2c0292f71536cb228", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440690, "uuid": "6c7a375d-ae51-416f-b6b2-be9b2ee675e3", "comment": "Malware payload (AveMariaRAT)", "value": "32c00e95b5f398c7bb7261feb35290e34c59d21f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440690, "uuid": "80096f96-dce5-4a77-be52-49c6cd2d2ee4", "comment": "Malware payload (AveMariaRAT)", "value": "4c861fe786a05b0aa85f3e2aa39f9029779e7d44735c0131239c39eece1ed0b66bc1fb5bdd33dd026d4f0b34782f254d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440690, "uuid": "1b7744e2-b887-41e5-9efb-04f6c736ce01", "value": "T1FF94BE9433AF6B45DD399FF4242C91D253F66C3721A9D3690ED5B0EA2932BB00E90E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440690, "uuid": "dcfdc708-0de4-496a-9aef-ffb4a4e8258e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440690, "uuid": "20674f15-9c9f-47cb-90ae-4fc5b722c592", "value": "6144:tJL/iqv7nh6Q+3HwOcc0WNm/Q6/hpMEceEOfxY5J+MlqGwwQ1vz+SaD:Brocc0W2QimeEOfxY58MlDmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440690, "uuid": "b1ec3b20-1208-43ed-9102-7369c69f2894", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440690, "uuid": "1a1ac71d-0845-4b5d-aeab-fcdd68dda65e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440690, "uuid": "b3f52b68-6b1b-4152-9825-3783b49a6890", "value": "STATEMENT OF ACCOUNT_2021-10-04989829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e936ae98-25ae-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633419370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419370, "uuid": "8e22dac7-eebe-4f6d-8576-cf1ec81f1897", "comment": "Malware payload (RaccoonStealer)", "value": "31eb4f5fe8282c8907a20a5352d5c91e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419370, "uuid": "5663c625-793c-40f2-b67a-28d513707a83", "comment": "Malware payload (RaccoonStealer)", "value": "01835a99cdc47442bce565fcd41922c495c70afe998b0034a9870576785a0a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419370, "uuid": "a224c43f-16a1-413e-a2a7-1a099dc64507", "comment": "Malware payload (RaccoonStealer)", "value": "830bb5a2902d8745605bcd2ac22910a3b498c136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419370, "uuid": "627a5827-7636-4254-9db7-d8bad2827e73", "comment": "Malware payload (RaccoonStealer)", "value": "912b502e58b00d79ecf60fcd3e4a4a21ff34ea78d65a3694040dcb767405ab0fc52c517bf42e7942091a614d836cfa8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419370, "uuid": "d7cd4079-d7c2-4e81-9b95-a1ee57af2ed3", "value": "T11AB4E030A3E1C034F1BB52F449F883B9AD39BD71AB2891CF52E556EA56246E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419370, "uuid": "d45d6c3d-b1ed-49cd-928e-e4e858b7fdfd", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419370, "uuid": "0ead81ea-e61a-4302-a4f9-bba3d73f6a6a", "value": "12288:foA4HLVEjEtyd4PjU6VyA/1nTWJvrX5F8j9u/TSfzU+:lBEt4Aw6VyA/6Lz85eTS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633419370, "uuid": "7a00148f-35ff-4901-9c80-a7633fca0f93", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633419370, "uuid": "5cfb6cbf-7002-44ca-be88-4a4f578fe3a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419370, "uuid": "f55d9505-d569-4432-a506-336cefb2c9df", "value": "31eb4f5fe8282c8907a20a5352d5c91e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aa1b37-2580-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633399311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399311, "uuid": "b03f1a5d-5320-45c6-acb9-53f186d0039d", "comment": "Malware payload (RedLineStealer)", "value": "6eb2feee2eca144b665d472f56a0420d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399311, "uuid": "5589d356-4fc5-4c64-9b00-51fa802dc63c", "comment": "Malware payload (RedLineStealer)", "value": "01fa6ab44dda66d487443953bccaff76a1399033de53158e06f2efaecda0bfec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399311, "uuid": "81d21db3-116a-4733-9ed0-5bb93ce25f1c", "comment": "Malware payload (RedLineStealer)", "value": "3e17bb5aafd5f363bebc43b7b201fd333c7819ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399311, "uuid": "686dc70b-4f17-4076-b316-e6e1db147d88", "comment": "Malware payload (RedLineStealer)", "value": "f2af4b6ebf1e221e8003be5e06ce11548087fe2f62c8ee18c5d7b5cc41ad98474f265fce02ec72d241c239ed51965d22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399311, "uuid": "73fa7c54-2b2d-4e86-b2bb-6abd50dab944", "value": "T123064BF27A0F92EFC34A58F4F481D903D51813F28658A559DC297838D783D6A21CBBDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399311, "uuid": "374fc832-4143-451f-8343-7777792518b1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399311, "uuid": "ef82a3cd-6c83-4365-8974-3ce3d70b7f92", "value": "49152:L/B4rO6JHrGZYQ8hcEe//l5UxUVbH6cYLFQCS:L/aXHrGN8hcEe//lxpH6cYLOCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633399311, "uuid": "7497d7e2-c8cb-494a-b3f5-25899551d15d", "value": 3954916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633399311, "uuid": "72eb261a-48ec-49e1-a6c4-627d97b434e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399311, "uuid": "e5a8892a-a6ed-4761-9d01-199b3edbbd47", "value": "6eb2feee2eca144b665d472f56a0420d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabc0b47-25cd-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1633432634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432634, "uuid": "71656d74-78ce-41ea-b59d-7816f48078ec", "comment": "Malware payload (CryptBot)", "value": "d8a8599e2325010e356d1bf13395e0af", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432634, "uuid": "09bb6db7-2f9b-4c55-b2d0-eb551cc350d6", "comment": "Malware payload (CryptBot)", "value": "021fb6384caf7f0b9afadbe363849424073d001c162eaa30ec1c4e18359734ba", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432634, "uuid": "94f572d7-01bf-47c5-b81a-41697bd1a082", "comment": "Malware payload (CryptBot)", "value": "689a59ba3a0c4cfcbae7201cc09a986bc968b8f2", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432634, "uuid": "71fa3b6f-3fbd-4bb6-8c83-153078d25650", "comment": "Malware payload (CryptBot)", "value": "2e1b4deac4a7751f8927540f8e386de0c04a128d93ac43097189c4740989d6facf9006ee93541d5b933029bd2c1e0940", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432634, "uuid": "e8e56c77-26f1-4000-95b7-4107d28e2faf", "value": "T16A8523323AE45175D6DB07708AD37A7C89EDA3612D398683791E01C92F6CE46DF7B00A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432634, "uuid": "8f654252-6b5f-4d06-bc15-0c88a99af2dc", "value": "40ac8f0690f137f6dc69a66d8831bd15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432634, "uuid": "e00d9690-b420-4c8d-8a99-23af5d8f3d8a", "value": "49152:6sOXm4VF5ZCVpSm3/gjkl0+827d/GpncQ:6nxwDf3IjX27ocQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432634, "uuid": "880d8ca3-986b-49e5-9807-bb361578e922", "value": 1858323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432634, "uuid": "f1d14c2f-b18b-4c7b-be84-02b55c2761db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432634, "uuid": "7249f961-d86c-4281-a5f7-e80de3b3d1cc", "value": "021FB6384CAF7F0B9AFADBE363849424073D001C162EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b4e722-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633417051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417051, "uuid": "3b19a3f1-346e-4661-b2bd-15b3880aac5c", "comment": "Malware payload (SnakeKeylogger)", "value": "6b839be3c8a9b891298c4af0c7bcf080", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417051, "uuid": "dd472024-4797-4fda-8264-131da8707215", "comment": "Malware payload (SnakeKeylogger)", "value": "03b3fec4b598d7b48159f3c70ac01f7dd4e5b6a90ac46402b5b4325c6ee04725", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417051, "uuid": "99e60ae2-353e-4afb-9e34-90d738f62895", "comment": "Malware payload (SnakeKeylogger)", "value": "ab7b3d9b329d0f451dd3368c98fc3442b411cba2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417051, "uuid": "6e26f73f-1442-4c50-8343-b8667eb57c0f", "comment": "Malware payload (SnakeKeylogger)", "value": "10c1d3be2df2351768c1d9653a240cfd3e97283a8c5a3458190c4c9e492a836cb0b6822b4711a1dd6265ba271981a661", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417051, "uuid": "e27519c6-6d48-4c87-af78-be6936c19608", "value": "T126C4E08170AC81D7E5AA0DB2ADAFE53531E479CDD1CA504F3699BB6A20F2362441F33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417051, "uuid": "a815a0d9-7e91-4ef8-a7af-f244dfaee4a6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417051, "uuid": "5e74c911-dd2d-4f6f-bec1-4cb2cc8b4b51", "value": "12288:AGlaKpNMmGYI16ofXgJceH642dw/dDsa8K1:JlppNMmGV1ecYV1Dsa8K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417051, "uuid": "c4813cbb-5a86-44cf-bc10-cf0b9543cc41", "value": 563801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417051, "uuid": "3e271af6-ea6e-46df-9402-985a2b801cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417051, "uuid": "23699ee6-fbf3-474e-b17f-fcb9fde3b11f", "value": "\u8d2d\u4e70DHL_119040\u6536\u636e\uff0cpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bb872c-25a6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633415769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415769, "uuid": "d23e86d7-5d26-4fe8-b021-ff6aec01db4e", "comment": "Malware payload (RaccoonStealer)", "value": "0f1f7f8156a5baa1be245af4ed77f216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415769, "uuid": "433213d9-14c4-490e-ba1d-c1e523c21715", "comment": "Malware payload (RaccoonStealer)", "value": "03ec17c06bb414d544f4ae0398db3356ff8fc67b491ce0a1a10927a2c78c415d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415769, "uuid": "8fb19c86-6c95-4345-9ca5-e2b0f125bf55", "comment": "Malware payload (RaccoonStealer)", "value": "8499a306b98078dfed295574a27de8c6468a665d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415769, "uuid": "3d07a111-caac-4ed4-b0c0-e572ac8975c0", "comment": "Malware payload (RaccoonStealer)", "value": "0948ecb3dbc607d24883f038f7a8ffd2bf72b3903cf56d1b65f1fb3c4b7e18f5bf8f9a96307a5d3e80bdd2ae13c394ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415769, "uuid": "7a6f049b-cea1-4c98-97dc-654b9ef1892e", "value": "T121449E30A7A0C035F5B712F449B597B8A92D7EB09B3490CF52E41AFA5A346E8DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415769, "uuid": "2041a683-6ab3-447f-ac14-ce0b4fb20dd3", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415769, "uuid": "997e79dd-c47b-4f51-9977-c9b040ff52d6", "value": "6144:5o6fJvg1Ost9pfnOty721o5r6j50dHOctztM3ninhLFO:5vR41Ost91Ir1o5r25sOctzW3inh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415769, "uuid": "ccd05f30-84f9-4f19-9b3d-1d9dee9fba25", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415769, "uuid": "a067ab85-203d-4a0d-9eac-c5dabdd23bba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415769, "uuid": "9056ca7f-ec11-4340-9bd8-92c8e1cc12f6", "value": "0f1f7f8156a5baa1be245af4ed77f216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0021a1-2580-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633399320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399320, "uuid": "c0357214-55cf-49a9-b2f5-d3db7053f44b", "comment": "Malware payload (AgentTesla)", "value": "09ea679f5c2a7265f399dd573799f7ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399320, "uuid": "0fc0a73e-9dbb-404d-befe-1f6b06699760", "comment": "Malware payload (AgentTesla)", "value": "08308a421943014b117236d146c4a6514116daa0a8ae0b8379ccfe84b4f0b09c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399320, "uuid": "702e9355-9dc3-4f4a-b3e8-6a3cf44900b8", "comment": "Malware payload (AgentTesla)", "value": "00860df49548b17be8fc13966651f0d7e4c80541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399320, "uuid": "e928faff-caa9-49ce-b2f5-5c9dce0b266e", "comment": "Malware payload (AgentTesla)", "value": "77c7de1360bf4044e8861221eab65947e02e9e1271cfe9989c5b431a6835ed0ac01f2ff74e26ce278190d86fc96be5cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399320, "uuid": "af2f54d9-8165-41f8-aa7b-f9877019eabd", "value": "T18F242A566715D551CB6F417FC016820831F1DB03A72AD28F5AE5D8FA2F812CEFA2B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399320, "uuid": "93ad3892-1492-4dff-bf38-c78ce0701932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399320, "uuid": "8875c864-1a65-4c21-9bbf-f293fb07d8c8", "value": "3072:dGW9SijnPAKMfE3G8wSiUs8714vQFx7GaTorMY3ZoRFl5xHO3KBChk5fhmvztW8A:dyfWGjZUB14vQ+DoYJinREk5foZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633399320, "uuid": "7f63d564-db7d-4a62-8f24-1cd0b7e2fe81", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633399320, "uuid": "fabca90d-4a62-4116-8713-d33cdb9a806f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399320, "uuid": "4c19e6cc-89f7-4930-aa48-2c2ad4de5455", "value": "09ea679f5c2a7265f399dd573799f7ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e5e4cf-25e5-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633442828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442828, "uuid": "0493ccd7-c032-4b4b-afe6-df867f35038a", "comment": "Malware payload (NanoCore)", "value": "a73628e84e1e077c8d0fee4977ae9198", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442828, "uuid": "f4da5a91-d942-41fe-bc48-5ce00fba0b98", "comment": "Malware payload (NanoCore)", "value": "08368431a17b72f3dcd97806a666177aec1e3072eb02d2cf414f9baa0c15882c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442828, "uuid": "ee3d1279-3ee4-41fa-bda7-2c861fcaec3a", "comment": "Malware payload (NanoCore)", "value": "9b0402149cc3bdfba5d17884a891f61590e860a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442828, "uuid": "d8a9b887-65e2-4596-a909-53ca0ba4c68f", "comment": "Malware payload (NanoCore)", "value": "9141ce0a17319916ec7b188e74248e76231f36e736b252a1e417a414d0be95a0b4ad8eda67fd34e531aa683bb3bf3da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442828, "uuid": "6707309d-a231-4bd1-96c2-153246177998", "value": "T1263559AC321375DECC67CD769A6C2C60AB602877530BD213A01725ED9A1DAABDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442828, "uuid": "a9726b72-47aa-41ce-917c-f5da14c49718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442828, "uuid": "1f4bc808-c0d9-47d0-ac0f-b969cad6f8e1", "value": "24576:hU1wWN6yc0WwSVbUw2s+AIEQRX4g7DzwxHzkj:hUKWNV6bUDLn4QDkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442828, "uuid": "91c05da6-8ca0-4015-a2b7-863e0e0fb2e1", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442828, "uuid": "1ca0cd1d-dfe2-422b-bfd7-0ffe98976dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442828, "uuid": "421a0448-2aa1-409b-87f3-f4c61a4f4c22", "value": "a73628e84e1e077c8d0fee4977ae9198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6c38a1-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436962, "uuid": "55f24265-ff83-4553-98ba-d8ef78084e7d", "comment": "Malware payload (SnakeKeylogger)", "value": "08ce041697745a1b29727b09555918d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436962, "uuid": "dda6d14b-91d3-49e7-89e0-2927767bd4e3", "comment": "Malware payload (SnakeKeylogger)", "value": "08e55223b0a8da57702711d7441d1bfda8517ec87aedecb0bc270da6f24ae5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436962, "uuid": "e5020f3e-3349-45d0-aaa0-783a5ae5e186", "comment": "Malware payload (SnakeKeylogger)", "value": "1bbd5db361d9585e72f723479b991b04e714d870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436962, "uuid": "0c3cc333-90b0-4eaa-838c-1b70161a0473", "comment": "Malware payload (SnakeKeylogger)", "value": "505783c5f6c594b32ec31ec91711321411384beec6253a790f2626ed42eacb15d71d40959ff9b942aaa1137ead1dd889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436962, "uuid": "592df79e-aa2e-4543-a1bd-8bc4905c98fd", "value": "T19FB4E03DC7630615CE7887F23828D2B047F9AC5892CAE7BC5EC4ACEB39637B5955440A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436962, "uuid": "05bf9630-16e6-44ef-ad49-43b7cb49dc78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436962, "uuid": "fdde791f-13b9-4347-b1e0-e81039aacbd9", "value": "12288:yqIof1TdNZnoHEDEhAGprOESOZy9NDN8w:lIopkHEDEhfprOEhZip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436962, "uuid": "81405270-d8d9-4622-a59f-0d099f49ac11", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436962, "uuid": "75c4ba72-5b13-44f5-bdde-a523bd36c030", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436962, "uuid": "671a5a8a-d9a1-4b77-9c5e-c14bb633d886", "value": "B22T3HrDXsC7ZZE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddee2d2-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633411271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411271, "uuid": "e652027c-4bc0-49ce-bb52-241cbaaeed32", "comment": "Malware payload (NanoCore)", "value": "44158fe823fbcc7e729caf2ea23f5902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411271, "uuid": "338bba0c-d782-4192-a063-2e8249cb93b4", "comment": "Malware payload (NanoCore)", "value": "096d51d0807cf7795457f0bfced1d171cdab969b2fd20a80f7349ea25feec154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411271, "uuid": "4a22aede-2972-4228-a278-d5b1d61752e9", "comment": "Malware payload (NanoCore)", "value": "8d60045d964e1c1aec8f8adf3314a78b41c87752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411271, "uuid": "43e09a11-499a-46da-bc7d-831bfd3f5ce4", "comment": "Malware payload (NanoCore)", "value": "bf0bd441b064622360a9da24a0966d1bbca1715727ebdd129407d0cdccb7892bcecd3f6a4a858b6ea689c581a4d812a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411271, "uuid": "6b5e2fb9-02c4-4a46-b670-f7bf1922878c", "value": "T12DC45BC1D6883CF5F81917724D36AD262157BE7C99B4542EA95EB42A5BF328330B3C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411271, "uuid": "24912145-b137-47b0-b527-36f16f18c89a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411271, "uuid": "374ae7dc-13e8-4abe-b6dd-1f8ea30e7042", "value": "6144:p8LxBq4sYGXW+37jcBsvRQdIewplYyByl/AM0sqBBupy7ekW+S7WSCwpsOs21kKV:UGXW+Lw6pQN+lYywA6q/D73S7WSjie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411271, "uuid": "395c9794-41c7-4b2f-8075-4a09a7389458", "value": 570196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411271, "uuid": "21b86c9e-965e-482e-b5e3-391e1334422a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411271, "uuid": "c5f49e68-74be-434e-a078-d216a735e415", "value": "765-3523663 ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2ed42c-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633442010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442010, "uuid": "f12ae605-ccc7-4983-b32b-0f02d274c90c", "comment": "Malware payload (NanoCore)", "value": "33163ba51a75dc41121ba9fd510ace2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442010, "uuid": "04e91fe4-5f5f-4b75-9e0d-97af4c042f0a", "comment": "Malware payload (NanoCore)", "value": "0a31de8a2ecdf9fa65e2ba65a5ee43d954937141b84167b504446e6a6c209e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442010, "uuid": "9efe963f-c2ca-4d05-9be5-f5c60e72ed8a", "comment": "Malware payload (NanoCore)", "value": "4a70ceaeeb930ad20f02e4c2b7e2d62871a62d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442010, "uuid": "6fde6def-951c-486f-a58d-15a0e50c1fa6", "comment": "Malware payload (NanoCore)", "value": "f2e3983ce431f2d8d0cb00eb760494936140036165ecf42377a5b6145481b689be238fbed1aa750357419613da3904e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442010, "uuid": "dd25923b-2f2d-4c35-b5b1-4a5b812c753b", "value": "T12205F69053CB88C4F57B2639B0122CEBB87D6E0DF3ADCF0551967A978CB9780561DE88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442010, "uuid": "ded6024e-d6f0-4ab7-9717-90b96cced6b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442010, "uuid": "15f3fe41-e840-4230-8b85-a0f2a916d0a9", "value": "12288:mWIcI046Mnq0UnsO5lJkKzUvoPUu9YjLaGnyJGirBaBaEJmaC2LAITToiYmytb7E:meuXyA3Q32LAITToiz67D7YDpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442010, "uuid": "1bdf1a69-9a02-4ab9-87c5-9fb434b096dc", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442010, "uuid": "1576849b-55bd-4d38-af3e-e2f6d4ca82f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442010, "uuid": "53cdef6c-e5d1-4d83-ad03-ec59f6c77c66", "value": "Mts~00037363673893-09387633783876337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8261ca0b-25b4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633421775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421775, "uuid": "d5b27575-895b-4c4c-bd2a-617eabae98cd", "comment": "Malware payload (Formbook)", "value": "1d6ee7c0d6d827f3d7ce131fd2c69d5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421775, "uuid": "011a9514-1f2d-47e7-99d0-aa9dcaf421fc", "comment": "Malware payload (Formbook)", "value": "0ab5b36920783c2ba772f2a06ef832e22c07a551043dbae2c33cfcf27b1b238e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421775, "uuid": "cea87ed1-38c7-41a3-9679-d8abaea869be", "comment": "Malware payload (Formbook)", "value": "6db0c330bb18fdaa479e76a8c7ea1a6df03d17f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421775, "uuid": "0df9a43d-9d6f-427f-9861-0feaaa52f4c4", "comment": "Malware payload (Formbook)", "value": "b65b32b59f709e70f9e8d1298aaabd44691cb8c61316bf80919983a01d3bc0b680f091133243d3e89c6efca0240da03a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421775, "uuid": "16b810a0-9cd6-45d3-9211-d49731592173", "value": "T158C4F13CC6634715DE788BF73C28966107FAA098938AE3BC2D84B4F93D637B4A560417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421775, "uuid": "24970651-3f80-410d-9ac3-e11f80e312e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421775, "uuid": "2c02a9f4-5a1e-49b6-97a5-54917ac0c0f6", "value": "6144:ZAvQ+3HwOqr5VF8W1JS/ELBCzwGbS0yawbA8gbxaZ1nK12jC57yRrJhXK8DAi15j:ZAIo4jFv4/EwQ0ya2Ax6TjCNy9NDN8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633421775, "uuid": "110f1762-ecba-4107-bd9b-9dc64852e1bf", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633421775, "uuid": "49d862fc-2a9d-48b7-a652-2d44fe109cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421775, "uuid": "7fbe1fd1-16ea-4490-bdcb-e3228aa79d4c", "value": "1d6ee7c0d6d827f3d7ce131fd2c69d5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa0636f-25d2-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633434861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434861, "uuid": "462ed775-1dbb-4ab3-8a3b-3925b5ea55d3", "comment": "Malware payload (CobaltStrike)", "value": "45cdacba09aaf18977ac3efdb9efd6a2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434861, "uuid": "bf89f504-bf04-4a4a-b9a3-d555a4af3c68", "comment": "Malware payload (CobaltStrike)", "value": "0bccc0b8c5cdc0d402c3cb89e82a11d57babe5ad610a63f2cf7c3d30d69bc91d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434861, "uuid": "cf4b537c-ff01-4d60-8390-ae3db4c50645", "comment": "Malware payload (CobaltStrike)", "value": "4db736c6961448294584bda83d4e3d94304ed757", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434861, "uuid": "4adb5c13-041b-4690-b626-0bd822fb93bb", "comment": "Malware payload (CobaltStrike)", "value": "891eefb37673825228173f5a9f78714f9f93ea316fe85bd86f1511198d34030394ddcd0da1349cd779443a75bd19d2df", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434861, "uuid": "b12d13bc-5f84-4734-913d-5bb0c30a4853", "value": "T1E624CE31360F3DBFF82548FC68D1103ADF65AEABDA9CCD4EDA9CA14046C994B0F12426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434861, "uuid": "418e9524-a945-4068-8045-0fa007ed5128", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434861, "uuid": "e841e743-2560-40e1-ab01-7a935ed27318", "value": "6144:ndbIm87Xx9Ux+iQoLPbQQ/30p2MpVxNk9a2wCgNK4:nlr87h9QQoHXc1S56j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633434861, "uuid": "df05b4e0-9239-4bff-9b67-bf8e3b93e352", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633434861, "uuid": "a48d6f0f-a80f-46d6-b0e7-3169ff2b849f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434861, "uuid": "e95045cf-1f16-4e85-85ab-e43e960da51a", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38845c3-259f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633412918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412918, "uuid": "a0241d03-57c8-40d0-9e7e-cf121dec27ad", "comment": "Malware payload (Loki)", "value": "723ebc30ee10a2873878161c544f6486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412918, "uuid": "f195dea6-bcde-4be2-b514-38bd332d75a7", "comment": "Malware payload (Loki)", "value": "0c35ba22e70aa20d0fc899ab80de86ec3a9d0a14b6578b50a162465a93f78c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412918, "uuid": "ec24b4e0-c0ee-4538-ab8d-d4f3d1660e6c", "comment": "Malware payload (Loki)", "value": "705179049b3b6d6f5dc681253616a2b144f1fc04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412918, "uuid": "4aab504c-d9ec-4cb2-9076-a83b9e79ea96", "comment": "Malware payload (Loki)", "value": "25080c7a9a0768404f549f5e387c3ba0b829a3eb71ea6383b36b9b340c98a22315d6f698ad60faf1eccd40670474e123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412918, "uuid": "543322aa-e3a9-4f3c-addd-b4f256d7d573", "value": "T1A354221B85E688EFD262BF3168BAE79DF373184441812907CBE51E7FB47030AA755392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412918, "uuid": "36a63a00-3106-4afe-bdfc-b90081a8e7c6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412918, "uuid": "aa159f1c-9788-4c3c-9103-2d14c212121f", "value": "6144:F8LxBs4Zujwk+/ZhNBMqK3IdD1GpVR4JHMop/2jsTTEm/nbu+nBo:/Elk+RhzMq3dw3YFN2OTEina+Bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412918, "uuid": "7fcd9662-e623-497b-8381-25a8da44154a", "value": 300814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412918, "uuid": "af367b6d-4bc5-4efb-9b4f-9bed1bff1db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412918, "uuid": "4c5d5eaf-46c8-43fa-bd53-bf64a737f31a", "value": "file-docsx_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962b9b84-25eb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633445430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445430, "uuid": "17a314a2-a39a-4aee-9eb3-4e58d632828a", "comment": "Malware payload (RedLineStealer)", "value": "c9a0e3be7011a28f6d54ad09892488c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445430, "uuid": "90893887-b85c-4504-a86f-a8f7395232e9", "comment": "Malware payload (RedLineStealer)", "value": "0cbc80e5bf3b704047e62a5fb878b734c64db3229e0ac3e1ea6e153be0739a13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445430, "uuid": "10fc2a42-445a-45e1-a8ab-becb22925af6", "comment": "Malware payload (RedLineStealer)", "value": "91fd88b4f5d0d18cccbcd9f1f78f39d92801b673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445430, "uuid": "63839a0e-7fc3-4c00-be0f-a3b83ef67517", "comment": "Malware payload (RedLineStealer)", "value": "253b037c9ad662a046104de5aa3b7ed58f558f298fb25c68f7ce0c558a5d429a97c43728bd84af5b76f19929a14d5901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445430, "uuid": "c6c79c63-8630-46cc-bd0a-438973654d6c", "value": "T1A364C01077E0C034F1B752FA49B993B9B92D7DB06B3491CBA6D526EA4678AE0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445430, "uuid": "40e2f9ca-76d6-42c7-9f65-d3aecb630572", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445430, "uuid": "beca52f6-3c30-4523-aac0-5c0c8944303f", "value": "6144:q4KUVPQpDQtMOreDX1oLpt4QTiiHRpxaAIffsuK:qX2ADQtMOrA1oLIQrRjGLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633445430, "uuid": "105d6f94-2109-41f0-be99-88d591da4812", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633445430, "uuid": "bc97193b-9d2a-4df8-b26c-100353a4dcf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445430, "uuid": "db41e06c-2cd4-48ad-99ed-1eb0ac1bba34", "value": "c9a0e3be7011a28f6d54ad09892488c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc14c84-25ad-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633418844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418844, "uuid": "d33e989c-842e-4fc2-bd03-aa8730be4e72", "comment": "Malware payload (NanoCore)", "value": "e007d4f9bcd9d51aff452fa92631fb93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418844, "uuid": "560262fa-c105-4735-990f-ddd5bb5c69db", "comment": "Malware payload (NanoCore)", "value": "0d078f15b76f74f1d70d99dfe7bfb7ca6cade8c4398ab3771eb843cfc9a53380", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418844, "uuid": "5a6111d4-ffd9-4388-bdac-9cd3ebde95d3", "comment": "Malware payload (NanoCore)", "value": "996674d4c8cbe846e2decafa03a86469a4825656", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418844, "uuid": "6bf125e0-e1da-4ffd-a638-138aa83781fa", "comment": "Malware payload (NanoCore)", "value": "ec8aa77cbe3015a6be9ddbb46f182e7e75cd2202d27764a9246093aecb76fb5c872860be8babfeda72ec3e8b538c88b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418844, "uuid": "8d92c2bc-7130-4ef2-a9d7-b983e8c7de08", "value": "T1B064122575E2E8F7E5DB6BB61937AF26E73BC2022419524707E61E7B2D32801C80E2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418844, "uuid": "5eff6b01-45c0-460b-aaf3-53a5e30635f1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418844, "uuid": "bfff259d-b5de-479b-8ea7-c7572e23dd1c", "value": "6144:F8LxBsdsae/28g0p6DIUz1TT8NFUJo28dLowJcAscvsHHImNlq5:/dsK8g0p6Dv1fJon7cr7r05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418844, "uuid": "f7dd865b-5952-49c1-80c9-30ed34bd86fc", "value": 315359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418844, "uuid": "8352b816-591e-4cfc-b8ff-54251bcdf651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418844, "uuid": "0c7181cd-9d13-4a3c-a873-e6e7a9ffa776", "value": "e007d4f9bcd9d51aff452fa92631fb93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11596b5-25b1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633420618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420618, "uuid": "45cd8fd3-d0bc-4905-9f3e-9201ce41d31d", "comment": "Malware payload (RedLineStealer)", "value": "cd49a3ee3d3c0dac831788d22c5179f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420618, "uuid": "e98885db-dda0-429d-8146-1c8abf62c184", "comment": "Malware payload (RedLineStealer)", "value": "0d26472f54c976e09f3b9580078ff8bd545ddbe12877ec5e589145e19e2278eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420618, "uuid": "240a471f-871a-4833-b18d-8d62f18920fb", "comment": "Malware payload (RedLineStealer)", "value": "d3ded663ed57dadf828ac10d714618fb985fc891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420618, "uuid": "ef3bd66a-3c69-4843-96ea-c4bac21be6b4", "comment": "Malware payload (RedLineStealer)", "value": "a4b4bcd42254765be3feb2cab4ed25fb5289ff5907a4a46ca13571c505c3e9c3164baa3ad3926484deaa979538ad75bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420618, "uuid": "a00e41ba-a8e1-4905-9f2e-fe1ecc8d7018", "value": "T167057C8077EC861EE6EEA770D0F006C502F6F8D6A179D34F1927A9A91D92B414D12FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420618, "uuid": "d425bf76-08ae-42a8-8243-69369d9362b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420618, "uuid": "c9f7c039-2a9e-48a0-a1e6-5fac7b211257", "value": "12288:zcc/gecNU2zqX6lUB2AkeANRf9gM87VY9UPzy9BHIPxyTz0:gDNgWUB2AkeBMOkUPzyzoP60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633420618, "uuid": "63e0f3c8-f91c-43b0-979f-6c7ea66266e1", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633420618, "uuid": "ed1d71a2-102c-4357-a36c-690587e7b1fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420618, "uuid": "900f0e0b-246e-4855-ad76-9831fc5135a5", "value": "cd49a3ee3d3c0dac831788d22c5179f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a839ab2-25bd-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633425439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425439, "uuid": "1708217b-dd89-40b1-b60d-ac204602189a", "comment": "Malware payload (AgentTesla)", "value": "7cefad8ec2a885ede3083131004d8b64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425439, "uuid": "a471c123-c39f-4c6c-af43-95f7a47e01f1", "comment": "Malware payload (AgentTesla)", "value": "0dc2c75f5d109cf78fc472ad6b777d9bb89894358f4e88ed6f5cdf2ee03cf843", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425439, "uuid": "67f02206-a491-4fd8-b850-d1cf27cc91f0", "comment": "Malware payload (AgentTesla)", "value": "96e639c37fdf48310fe3ec281d12d930e0884a48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425439, "uuid": "b0a86cc2-3254-4afe-a929-6a892cacb4a3", "comment": "Malware payload (AgentTesla)", "value": "44b5b1e474619ab55dcfc4a5112ed63b1dba8b3c979219fdd2d8c00da026c6da28a3302ddc569002f3d915fd28d60c91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425439, "uuid": "0af5473d-aba3-4ce7-b893-618d5aaee1d9", "value": "T1A0B4C09423AB9F45ED388FF8181C619187FA7C372569D7690EC5B0ED2932B700A91F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425439, "uuid": "02b69df2-33e6-45ec-88c4-dc52413a3d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425439, "uuid": "a2a1ab1f-bd56-417d-9928-bc07ccd199b4", "value": "12288:CJocc0Wq58HSyYb3NZlLH0JGO56LCMrM6vmBkkK:CJrc0WquYb3flLH0JGO5jMoIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425439, "uuid": "2fe382a1-ee2f-4a44-b2a6-d6fdc0c3ebb5", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425439, "uuid": "0816d596-e78f-45bf-ab70-72b0975922c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425439, "uuid": "395fe9ca-2f13-44a0-b26d-5cd64122134b", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af247f4-261d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633466672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466672, "uuid": "1191a405-db7f-477d-b624-6ad45435f5dd", "comment": "Malware payload", "value": "13173913da1f35728d84e78a3de983c9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466672, "uuid": "f634a812-d894-49e8-9cc6-a38aeda94548", "comment": "Malware payload", "value": "0e6451e1f0eadb89390f4360e2a49a2ffb66e92e8b3ae75400095e75f4dd6abb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466672, "uuid": "dd80f588-b715-4b66-8570-1e25175a6290", "comment": "Malware payload", "value": "9a1437af2d653fc265472a47edab9f22d49b1941", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466672, "uuid": "9a25dc7c-7128-49ae-abc8-438cd80604d8", "comment": "Malware payload", "value": "3b011f0a0e38aad471803a2d68be8c24b88d251d7e8623437d83e814123241b9e0fe69085207ed7ae9dea1701827a147", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466672, "uuid": "785d6385-1b50-4cb2-88cf-83a66ab8fa2c", "value": "T196C42347730A2335CD66437286EB87E18B347C416E988A127A63765E9F733C4E6363C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466672, "uuid": "010be482-5382-43d8-972d-dd2a2682466a", "value": "12288:eF3LUk7ftIXeWc5ie52YOqhPS+KP/w1pZGGgCs5xu8:/aFAeWceYHPS3PIoA4xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633466672, "uuid": "f55234aa-9669-442e-a7fa-aadc3da1d413", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633466672, "uuid": "8fed24da-5c7a-4408-aecc-3f2d0e3477f2", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466672, "uuid": "a97b5fd0-d3cc-4082-b395-fa93568d8c43", "value": "SecuriteInfo.com.Ruby.Downloader.2.30598.13746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c01c42c-25f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633450057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450057, "uuid": "62da8589-3256-4a8a-a310-8e032441d4c5", "comment": "Malware payload (Formbook)", "value": "5242db71a9b5092dd951c947bb741164", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450057, "uuid": "851ec901-9378-4fdd-886a-14b8b6b6e761", "comment": "Malware payload (Formbook)", "value": "0e8042810f803695fa289c786f2ce51171276667da5e8a5ffd63f247dd06b056", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450057, "uuid": "1aafc493-984a-4883-b121-e8db5888bceb", "comment": "Malware payload (Formbook)", "value": "75d729a8e8c2359625c8f5761c8d9afa16b6ce40", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450057, "uuid": "48b94ba2-f684-488e-b417-23a635c71eb8", "comment": "Malware payload (Formbook)", "value": "30260bd819c4fd4e9d0e1a56259ef2af2ac7eced0db2c8848cb9a02993db01336ab2b0a8994c42e30aa42a02d0da4bbe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450057, "uuid": "4dab524c-13f4-4189-bbfd-ebd1dc87cec3", "value": "T199D2DB7DF1870A888F4697B8170B6F42164CF51DF3D984B236B8DB3866D1D7A862293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450057, "uuid": "0c86fe18-c856-4a51-949a-a2abbc3909d8", "value": "768:/gENANNhu6F/LwhVdM/vY2Jc/ooH5FAhVOZuBQwPkbxfGfiWem5U:/gEqNNhu6F/LwhVdM/vY2Jc/ooH5FAhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450057, "uuid": "35e57dbf-1516-497a-968d-8bc36ede6dab", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450057, "uuid": "76d1bf6b-312f-40a7-96b6-abb417a0bf79", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450057, "uuid": "c33518b0-c5b0-454a-b5d3-d67e38d6323c", "value": "PO-6733278964237899.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e6e9e4-25c9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633430805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430805, "uuid": "dce97fd3-94ea-42e8-a33b-78fee816dcc9", "comment": "Malware payload (RaccoonStealer)", "value": "e5ed87569234cd0be1249b965a546dfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430805, "uuid": "41d83d81-e66f-4b91-b528-8ff6e0f73109", "comment": "Malware payload (RaccoonStealer)", "value": "0f2f07e8e52593a89b1d2f0ac369e53d489295078d50a1f0bd42dfcb17e0c6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430805, "uuid": "14ba4ad8-dd23-4f33-90a6-fd5035d9fc64", "comment": "Malware payload (RaccoonStealer)", "value": "30264ad66b063d6bfaa6fa775b58914dc760d967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430805, "uuid": "895c8700-2863-49c3-8ffa-921e051df3aa", "comment": "Malware payload (RaccoonStealer)", "value": "1a31a6ad06bf50dcff6efce36932ddcf79ae7bbd8c7aeaf6292ed2b62130a9700f86527b9115400b0c4fb491d95c2c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430805, "uuid": "37c29aa8-e37f-4a6a-9bc8-7bbf2be6404d", "value": "T137B4E120A791C030F2B751FA04B583B8A52DBDB09B3495CF6AE527FA46786D0DD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430805, "uuid": "45b2b40d-d16b-4e09-be55-12646f89ad7c", "value": "bec5279be0cb3c653f5b0b143b00a99c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430805, "uuid": "e13d7e10-3a22-407c-a4ea-7fe2890cc551", "value": "12288:DUDYMs7SdUj2MxP5ut5+nn/H4ynurYE8WVcJWL:mOSdTU45+nv4uuMEvcJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633430805, "uuid": "f382036c-44c8-4805-92b9-ee5a11e6f589", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633430805, "uuid": "059261bf-f438-45f5-a101-786c0089c947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430805, "uuid": "bbc0aa7e-c4f4-4bd1-a750-70e82264440b", "value": "e5ed87569234cd0be1249b965a546dfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06131fb-25ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633419356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419356, "uuid": "7c0e40cf-ddb1-4897-bc8c-3f85f6797877", "comment": "Malware payload (Formbook)", "value": "29a2ea2de2e06ff44e764795c83fbba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419356, "uuid": "a2cd9718-8dfe-4a57-9036-5407dc90b668", "comment": "Malware payload (Formbook)", "value": "0fd790dd8e570e52beff29e4870f712cad5965f0271f26df4081d8b3ecb3be86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419356, "uuid": "7f8b2af0-c244-4076-9889-f0bcc89ba931", "comment": "Malware payload (Formbook)", "value": "4d8df384128e6c614c2a9f88f826c3b0b42ac2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419356, "uuid": "82ddaa55-4fa5-4e6c-b617-bbf6eb330d14", "comment": "Malware payload (Formbook)", "value": "2e0ac6eb76bfffe0b80ba81e660ce08133d86c61639b7d7a5e83712f1b1cc717b86a1c022d2d3b06be687435fed90d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419356, "uuid": "97246501-4e50-4223-8ab3-e2e96ecc6dda", "value": "T179949BC3728C4C91F8428A32CEEBD46F4266FAD0BFBDE4C56750EA5F58735A28661113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419356, "uuid": "d38265ac-23b6-4ed6-857e-7a56b8c37e0d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419356, "uuid": "d5fb2f16-4d36-41dc-bf4e-4f9c3e59f6e4", "value": "6144:08LxBUwrtihFS1EGfhxZgfwxcaVzvvgvZHS2bkCAAcHuu37uWom:I+ijzkxCwx5VMvpS6haHuY7lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633419356, "uuid": "53be4442-fab2-4711-b64c-473c84156c72", "value": 411385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633419356, "uuid": "b012720d-124e-4ab2-8e44-df4e8c113d11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419356, "uuid": "d7568855-cc46-4b3f-b058-9118fe16ae17", "value": "RFQOG051021,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26715600-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633412172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412172, "uuid": "740a1cb2-6ab1-4177-8566-614861764583", "comment": "Malware payload (RaccoonStealer)", "value": "96340b3431c2f14f44dfa00ff1ee8e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412172, "uuid": "d12a3dc3-c017-4236-9e9c-fd894e96397b", "comment": "Malware payload (RaccoonStealer)", "value": "105efe9d0da674f5a09a7c086bf69615ddad064d4fd9958ba674c351f1af5e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412172, "uuid": "a07e2165-da9f-4604-9375-7b6ea98705cd", "comment": "Malware payload (RaccoonStealer)", "value": "40c42d67785ddd09cbfb269e6e025d777d5d3239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412172, "uuid": "fe3b8499-94d8-42f0-9193-7d579f192cd0", "comment": "Malware payload (RaccoonStealer)", "value": "94f336d368533e649bb0072d38c0ab68b9e9050c313c3d0c2d4d9c2c3cb39739e6f88aa492fd78f8d3213a14b5a15441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412172, "uuid": "0170581b-5dae-44f8-b096-d6f8f1ae4c4a", "value": "T1FD348E10A7E0C034F1B712BA8AB5D3B8A53DBEF06B3491CB66D116EA46B46E0DD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412172, "uuid": "6db1bb03-22be-4150-9ec3-85258ec475df", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412172, "uuid": "848d3653-7636-4a51-9d32-baaffa54c3fa", "value": "6144:RorWeWHedXB+MnjBXTVfyKCvJUse61QYQna+:RKW+1B+MJVfyKCv861snL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412172, "uuid": "3684d9b2-a409-4c30-b3e7-f5709d155f3d", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412172, "uuid": "8b779a4c-d83e-4494-a2a9-c28b8f0776d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412172, "uuid": "3901ab4e-0e58-468c-8614-d91b5889eae7", "value": "96340b3431c2f14f44dfa00ff1ee8e6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a859860a-25c5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633429140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429140, "uuid": "4110b345-94fe-4481-9278-179baa3f8777", "comment": "Malware payload (Formbook)", "value": "a66216ae3ce6b9179a2afdaa47c64524", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429140, "uuid": "63495d07-e7a1-4640-811b-4282f7d9f7cd", "comment": "Malware payload (Formbook)", "value": "1101eea5587276e13c0adc7660cd5ad38595ba2ed73d85874fb2963b2e0f5259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429140, "uuid": "9fe23de0-8a73-4397-b2e4-af2458e92c44", "comment": "Malware payload (Formbook)", "value": "4b31e0eeebb46529270006755f47895b6effa923", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429140, "uuid": "84ef5dd2-0702-4ed5-bc12-0154b85ad89f", "comment": "Malware payload (Formbook)", "value": "65cc39b48a4cd68589780b81ba0bfbbdee23117d63190840f257b321c25d641b9a22ac1c99b47dafc28e5b3b942a3e71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429140, "uuid": "8c7ae17b-f765-4f2e-856d-38bee1f30521", "value": "T19315495222C91B66E03E97BA91746049EFF1F597C325C98ABCDE42F70F71F815A13A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429140, "uuid": "5678f474-e18f-4677-90f0-1621a008337d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429140, "uuid": "c531c145-9da2-495a-90f3-c65720ed8ba6", "value": "12288:MDBlCbl0g3DJUs3DJUVF3DJUBNqx/xJqf59ZFfU7i9MXc6zCt:SC7zJ/zJqzJgQ+xlUO9ocQCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633429140, "uuid": "51213e65-ac37-41e4-b817-ba6c09edd2e0", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633429140, "uuid": "78c3b349-966f-4946-8c74-2d4847b2f922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429140, "uuid": "7673143e-0bfc-4e7f-bae2-e6705e76f71d", "value": "a66216ae3ce6b9179a2afdaa47c64524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401db3fb-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633424241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424241, "uuid": "a1793c98-02aa-403c-9bd3-5cb58804f015", "comment": "Malware payload (Loki)", "value": "cbf6f703b4f19e4e44ae56753502b70e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424241, "uuid": "954385b5-38b7-4657-a6a9-8de56fc156fa", "comment": "Malware payload (Loki)", "value": "11067ea024518bb4587a4573d45b6bf485c842fb3141fd7c0469703709f7d5c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424241, "uuid": "c9ed015a-ff1f-479e-a047-c3b4caf188d8", "comment": "Malware payload (Loki)", "value": "92fcfe4e1376310472e4ec403ec7f75246142d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424241, "uuid": "3c2ec2ba-4f09-4b5c-b0b3-3f6ccf7a4a37", "comment": "Malware payload (Loki)", "value": "500ace9117105948bb447fb4e5f31877bb6d158d4d2406c5f8dea7670751c40595f027e92d35d83950ba8c643c772ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424241, "uuid": "a18ed681-8936-4250-a85f-7763be7fe185", "value": "T119D4016E375074AFCA67CE7689602D50AA30F07BA307D303B057629D5D4E6ABCE215F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424241, "uuid": "d6fa8d8d-66ee-4655-b349-f66e43a6a600", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424241, "uuid": "8418ad5b-6a44-462b-9ab0-0e5817a379e3", "value": "12288:6mtiK5oBG/gnHxbflaFrALuUGHKqYlbexpude:6+FoBGixbf0ts3OKqYsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424241, "uuid": "e4ca9b5b-dddf-43a9-8353-506cafccf65f", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424241, "uuid": "dae7c263-42c3-4578-a794-4e2adedf1e81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424241, "uuid": "99ed152e-91bb-48ce-b874-2e7ea597904d", "value": "cbf6f703b4f19e4e44ae56753502b70e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850b74e3-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633440677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440677, "uuid": "55503685-ab05-4015-839c-398a1591fcbc", "comment": "Malware payload (AgentTesla)", "value": "24a3726a4cdae0c2b7bb5ff40f87f6d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440677, "uuid": "07f759be-70cb-47b5-b60d-5051405b1b89", "comment": "Malware payload (AgentTesla)", "value": "1109c21d9a6e3f310fff45c506fdf6360e008574d4acfc47a470c22a427556b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440677, "uuid": "d48bf5fb-d0db-4c2e-be3b-02c2fb4352d1", "comment": "Malware payload (AgentTesla)", "value": "977d0f2ed868774f5805f3de6c1c5069998506ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440677, "uuid": "ee674c49-84c9-499e-8969-c3ce41ece296", "comment": "Malware payload (AgentTesla)", "value": "892a6741ff4a6489c1168ef2a37677d9c811091b8420cf4ac77e1d33c66f8db80b662e9c80ebb2b1c9f88314d2853263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440677, "uuid": "e5cfa9ce-bc45-4eeb-9b6a-c86e2287ecbd", "value": "T185E4C45B3E93E58DECD2897D49FC1C22BF12E8A6020E4FD340D773AD5988956FA60463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440677, "uuid": "c6a963d4-b41b-4337-8045-6c524625ed0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440677, "uuid": "29c1a494-21d9-48d7-b9ed-26b666b1bea9", "value": "12288:3L98kOXm1efXDunprGqC2bVPOfLplXciIXBCQyh5vF6owllEo0t:3LaXm1wEp6qCtht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440677, "uuid": "d93650aa-be45-4f2b-9b5e-ef62f7b27c80", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440677, "uuid": "1541ccb6-c891-4e0f-bef7-836ee08f5aa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440677, "uuid": "b89179e3-8ede-4798-9a24-bd1e279e1e2b", "value": "PAYMENT SLIP-REMITTED .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996adf32-25e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633444147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444147, "uuid": "829b2369-db4d-49a5-a831-46e463454984", "comment": "Malware payload (Quakbot)", "value": "2ff8d7d820171d3921325071badedb01", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444147, "uuid": "033b92e9-ff16-4ee7-8bdd-9e85e340d651", "comment": "Malware payload (Quakbot)", "value": "113a74d1243f7515b69041fe4388005682ae2a43c2c71b22720bb72b658e1c9b", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444147, "uuid": "cf9f0e77-6739-47e6-9c89-9f7ec179a185", "comment": "Malware payload (Quakbot)", "value": "198cfc0d69829fbd5dbd48664712d7c4c666a06d", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444147, "uuid": "fae0b0f1-3b48-4307-aa74-9ac82ede6320", "comment": "Malware payload (Quakbot)", "value": "0f159bb58efd2505851b97ba965d6f3794d311c3cdae55edd39bc8119d037ce641fe454f1c8230a869eae08935bd458a", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444147, "uuid": "9e509eba-cd9e-437c-a865-555c36debb54", "value": "T178350E543A54F510EAA96972CF6AC5FD07057D09EFF1B49B78E03E0F2AAE8A3D511302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444147, "uuid": "9243d82c-9c27-4f08-a14a-e958607b833a", "value": "754866e31728d54d1d294b0b8d8e79bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444147, "uuid": "693993b3-1c08-429b-aefc-e8dede1cef1d", "value": "24576:+g/9GxisYespQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jg:+isYxpg0vxgtqcuABLJ2PiIsROmjbfg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633444147, "uuid": "ea396c7e-cde4-4ead-a778-479e2a4ac532", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633444147, "uuid": "8979ba15-8608-44ab-aa58-f7bf00a86c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444147, "uuid": "f79be51d-ddb4-4966-9800-410a75f4076c", "value": "44474.5966987269.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d42a8d-25dc-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633439048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439048, "uuid": "9543af3e-ea3e-48e1-86fa-132473c0f7bf", "comment": "Malware payload (AveMariaRAT)", "value": "900b1c9abbab7a08f9f89b8e12fd2750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439048, "uuid": "8742c3b2-8ecf-4fbf-9284-c20e6201119e", "comment": "Malware payload (AveMariaRAT)", "value": "1142c903a0559833481d199320d433f99a4599db90d4ba0db736a39a8729c7bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439048, "uuid": "147b9648-e9a2-4301-a022-3ccc714af0ed", "comment": "Malware payload (AveMariaRAT)", "value": "7e21e44ae28aa91a77771901675ec23f9e81f26e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439048, "uuid": "d7e7e79e-94be-4ef7-a7c0-a13824c83f53", "comment": "Malware payload (AveMariaRAT)", "value": "95c2f75ab1db961ddb4c4519d1cc0d48ebe9cb818c3e229e98b2fb7b9f4bf7d850c4ec47b99530a59728430edd5922bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439048, "uuid": "808cfc17-e478-4fe5-bcf9-07b224e61f02", "value": "T14694BEA8339F6F46DD359FF4141C519243BA6C372179D7690ED2F0EE2E22BB00A90A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439048, "uuid": "a7793214-66a7-4135-93a3-552880a34233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439048, "uuid": "1c69c52f-4303-4d47-9d63-a5de20815de5", "value": "6144:rOBO5HG8nhFQ+3HwOcc0W/r87Vp1o1V9bwG2k0ahDd7T9y942q+26dCc7YxqF:7uocc0WO+1V52ohDd7hmi+VuqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439048, "uuid": "894fab84-73b3-4eb1-b112-b995037b5808", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439048, "uuid": "88b9c66a-5592-4168-8c5c-a2d4efb1bd7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439048, "uuid": "920ffda4-930c-4635-8cb3-d3b5d169007b", "value": "900b1c9abbab7a08f9f89b8e12fd2750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100c485e-2603-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633455513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455513, "uuid": "ea514f56-662b-404d-9a48-a9b3f72d9c58", "comment": "Malware payload (ArkeiStealer)", "value": "374b71a9054a80a0249d71322b79c480", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455513, "uuid": "12573441-6660-4d97-afc1-935ea95a7d70", "comment": "Malware payload (ArkeiStealer)", "value": "14816f6846eec2f130ff1010f2c80dccfeda6b926f48a39ad89351d3c0ce73ef", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455513, "uuid": "ab486c82-c516-40ff-a4ed-83aa520ad8f3", "comment": "Malware payload (ArkeiStealer)", "value": "f8aac2ff23a9a33af53bc7878cf17f74e1725ea7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455513, "uuid": "4c6be776-664b-4a73-8756-bd5f94bcb8d5", "comment": "Malware payload (ArkeiStealer)", "value": "7fc2cd6b0ab13a08c0eb2708ec83ff5e5795514514304b7052bd115d11b7e4422e08e771ca55255ff4a237965d651fd3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455513, "uuid": "5f0fa228-a7c0-4df1-8ebc-2828bdcc098d", "value": "T1F1E40211A6D0C039F2B652FA48B553B4B92DBDB06B3491CBA6D536E90BB86F0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455513, "uuid": "436252a0-937b-4f91-81d5-cf21ec9b5620", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455513, "uuid": "cdb176f4-10d8-45ce-8080-33e464c7393c", "value": "12288:dlKAM2lgOE+FI9V7xs7p3fnHlG6opx6Bj++l07ByC4ffqwddyv:+MA+s9CfnFG7px6Bj+M07ByC4nddy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633455513, "uuid": "e3f22a52-3ee8-4628-8320-b12cc5cdd66c", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633455513, "uuid": "ff3e042c-f144-43e5-aa0e-5eb2a7deeb20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455513, "uuid": "d10e79a4-dabe-468e-bc1b-9ac4c011306a", "value": "374b71a9054a80a0249d71322b79c480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fb643b-25fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633452787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452787, "uuid": "10311148-239e-430a-b240-b532f11e7b14", "comment": "Malware payload (Metamorfo)", "value": "5170e64e7c9af35b74faf816f034c8d1", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452787, "uuid": "edf4a6aa-d945-4ca5-bf9a-9622b763f0b4", "comment": "Malware payload (Metamorfo)", "value": "150be267850e2cb2af92be68e8966204bfba255b28e0dadd2d193816892129c6", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452787, "uuid": "36683666-43e0-4f49-b44c-95e7f51b84ba", "comment": "Malware payload (Metamorfo)", "value": "ed9ebd773eab6ac31fc4584909257d19c41ea781", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452787, "uuid": "366fb80f-22ad-4e4f-be3c-e077e11b1a00", "comment": "Malware payload (Metamorfo)", "value": "9b6a8826ed156bd5933c6b38979179d78ebd8a0d8586aef6ec5f6e3a20a1ba8fcce3a9ec805b47a7e4ce55efcdc93199", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452787, "uuid": "52fa9f6f-420e-475e-8d5c-ad90d0fdc4f4", "value": "T12531BE051EDA0329C3B7CF7A1077A2464A76FC51AD935F9D80C497DE28A1054FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452787, "uuid": "3f18e941-cd52-4aa0-b343-d92d2eb9c0f0", "value": "24:8+JUHRlVo5kcbA+Ppl7k+/P+Ps5Bz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+hlXxE1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452787, "uuid": "090bacfb-9ede-4b7e-90a1-48366e543ecb", "value": 1546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452787, "uuid": "fc931a48-0c5c-48eb-92f8-3bdd608e6a12", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452787, "uuid": "fd804ce8-8a42-4eaa-9462-bd160f116a3f", "value": "BoIeto - 0510.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d05a03-25d6-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633436442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436442, "uuid": "184426f8-2340-41bf-b80b-2949115d3ce8", "comment": "Malware payload (GuLoader)", "value": "329726c8b97fe18c99f0834c332493a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436442, "uuid": "c32c33cd-6758-4b56-9530-fc35359dd7c0", "comment": "Malware payload (GuLoader)", "value": "15f9bf54d8c4f819663ee61dcae4d24190a518b4cc107077148dd34985c00d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436442, "uuid": "86f6689a-1509-476b-bd47-578b5e7898e4", "comment": "Malware payload (GuLoader)", "value": "68625af172344aa2a66ddeca5cf9affaec40ba5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436442, "uuid": "ff27f9ac-1928-4f31-8563-19ba5bbb09be", "comment": "Malware payload (GuLoader)", "value": "a8e52cd9526a4ed243252203cfb415780801c6b9a4821b8c06a43547b9609a8c6a9b72ea8dfd7856ea32431d82e5e0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436442, "uuid": "158e426b-2d56-48f0-a9c5-84df2b3a791a", "value": "T1B8C35C91B2E4DC44F0650A71CAB6C2F887D7FC9DCC52C70B2DA4790EBB7A7445A692E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436442, "uuid": "a59994b3-a1e0-439e-b637-82d363f247cb", "value": "461dc836626597933929a467ef09b568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436442, "uuid": "c993ba15-c825-4991-8605-785235c491d0", "value": "1536:J7CHr+jlLXJjHXCmGlOKFAXyER/Colc/SssVCZv3Ghem2YK5brova:JwrCsemAXyiaoGC23Ghex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436442, "uuid": "20c7e91f-0925-4b22-a833-467b91e06191", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436442, "uuid": "0d10d86f-494d-4c8b-a8fe-a3db86769909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436442, "uuid": "0eeb6864-6be3-4aa8-890f-513c1fd250bb", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a96336a-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633411856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411856, "uuid": "6b17ae0b-68ef-4af9-99d5-8e963e7b1490", "comment": "Malware payload (Metamorfo)", "value": "6b34d1eb2ac759b4c693c721275a8745", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411856, "uuid": "60d2c93a-d9bd-4821-913d-64006bed5d3e", "comment": "Malware payload (Metamorfo)", "value": "16184b7deefa162348cc37c1836dc9d2d63aab5887ae740f7cd2c67672b4d2cd", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411856, "uuid": "1fdcac80-5dea-40a1-9954-881fa8740d62", "comment": "Malware payload (Metamorfo)", "value": "3b6e74f41736e59b4012f6dc5fa5d51f97f09e2a", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411856, "uuid": "aed29f08-ff55-4576-8c34-ae4dac664bba", "comment": "Malware payload (Metamorfo)", "value": "4cf1b7d51d7430246eac28403295be3843056da1482bece01f6069bd70ec06c623d8e9fe02a3abfd6b7713fea7bc07c6", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411856, "uuid": "cdcb6c7e-4973-497d-8125-2e25752c4c4e", "value": "T124319E091AD6172AC3B3CE7A1076A2464A77BC51EE934F5D808457DA2861054FC34E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411856, "uuid": "17bc7bf0-1c95-4fe7-9dce-3f6cca129abb", "value": "24:8+JUHRlVo5kcbA+PplYa+/P+7z41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+hlY1n1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411856, "uuid": "ae8e1f33-95ad-4ba4-a1ac-2c93e813c8b7", "value": 1556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411856, "uuid": "a3b3993d-c57b-412f-adac-87500a482672", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411856, "uuid": "a2d2617c-16ad-4a99-aa84-8795e92fb1cc", "value": "BoIeto_0410.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f89bb3-25f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633450953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450953, "uuid": "fe5f09bc-7945-4a20-98a1-9b3538b6865b", "comment": "Malware payload (Vjw0rm)", "value": "ce0aa96eb1ce21148765e63998750816", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450953, "uuid": "e0bc7ce3-0523-4dd2-9664-bd2ae5092ec2", "comment": "Malware payload (Vjw0rm)", "value": "168358901b4b9e7cde2f23fbae4c661534f725ff4e765a280acc92ec7a105ac9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450953, "uuid": "388fc9e7-1be3-45b7-9f82-a7a1adbd1fbf", "comment": "Malware payload (Vjw0rm)", "value": "8c6815020de44c1d0f82bdcc82c8a70fa9c41cb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450953, "uuid": "7afd07c4-2650-4ef0-b142-44f4330e4f94", "comment": "Malware payload (Vjw0rm)", "value": "e3e1b7c818b286a39deba6198349ce34b77a2976774a9e3da16c203170b936e9c4804e61865a1a07f49fa34513b36f80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450953, "uuid": "f3c2baab-77a2-4049-9e74-d6c63b80eea9", "value": "T1D18381F74AD2ACB6B5B4C7A2510C9424CE60E1F4CF3A645BD947198E0EDA3462783F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450953, "uuid": "d3bd584a-c51c-402c-aae6-b269be78e73e", "value": "384:i7d33yVCIh5pCzjc/tCG55NucgN/A/2/s/K//g/P37/iIE8YAcCr:isxNXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450953, "uuid": "4fbb3617-cbf3-4398-80f1-ab7f6d0f0ac6", "value": 83690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450953, "uuid": "9c69e00e-479f-4dff-9ae9-858bb971e100", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450953, "uuid": "d280024c-52b5-4876-a0dc-e98c63fd870b", "value": "R6AC91M37C6Z5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82dec263-25a6-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633415763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415763, "uuid": "fd2d7eae-8597-4991-9f95-d74c14b2de65", "comment": "Malware payload (Metamorfo)", "value": "f3756d6e4921009597611012c33e7d40", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415763, "uuid": "14bffc28-3369-466b-b5b4-37cbd7f45084", "comment": "Malware payload (Metamorfo)", "value": "169ed843d8d2fb5041ef862c094931b17aa2888ae81c7f5defda9b10f5cdde49", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415763, "uuid": "3f19f771-38c9-439b-891e-8f47d3c04462", "comment": "Malware payload (Metamorfo)", "value": "4a6850932a5d384bec5218f3e6d4a57b513784fa", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415763, "uuid": "b811bf15-b2f8-42c5-9e8d-97cf29f88da6", "comment": "Malware payload (Metamorfo)", "value": "266b06cf6c014e88000d89f262e2baf1774c2c03bd85ceea165125cce986f3fc457c94a2721e0cbbc560dd8767276a6c", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415763, "uuid": "a0e6db9a-be5b-436f-8880-ee3bae8e133c", "value": "T18B31AB051EE60729C3B38F7A1077E2464A76FC91EEA34F9E808497DA28A1154FC35E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415763, "uuid": "0d4543d0-7ec1-41f0-b34c-7d319303d837", "value": "24:8N6JUHRlVo5kcbA+PplYL+/P+vG41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8N6uH+M+hlYUo51cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415763, "uuid": "6e6f6120-0d3a-4c4d-8063-6ec67e1ceb1c", "value": 1476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415763, "uuid": "4f9247bb-e4e3-4669-97b1-e8b554f66c8e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415763, "uuid": "14a723ea-d4db-4f74-8c84-040e310a0065", "value": "Outubro.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a5851-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633441961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441961, "uuid": "844532f5-101b-43af-a9c9-ce469cf5dbe1", "comment": "Malware payload (Formbook)", "value": "6c7770c6574821f08f549ea79fe07eea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441961, "uuid": "c7ff54c9-e44d-4239-b854-86101ed722a7", "comment": "Malware payload (Formbook)", "value": "18f25a6941b39471ea68715f7ab4b3f96990808ded5138054b96763179e0c19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441961, "uuid": "91b69a5c-8d58-479a-9193-7d130a9d19c8", "comment": "Malware payload (Formbook)", "value": "9bb5ae115b2bf4a25a4ea1bd554077174426cc1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441961, "uuid": "f4d0a1b3-40cc-47fc-b4a2-bbb19ce87d37", "comment": "Malware payload (Formbook)", "value": "2a203da1ed0d88b73a9dfd053310ef51be70831fb6eb4e9363844b91a5f5bd69a024c9ea79c1ff72fa417aa666ef3acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441961, "uuid": "2f1c8028-013b-43d2-a955-c865f0bb1685", "value": "T163A4C0A433AF5F45ED398FF4142C918243F5AC3751A9D36A4EC1B0EA2E62BB04E51B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441961, "uuid": "c02468da-c641-46dc-8b68-2c7708775b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441961, "uuid": "b1ca5d51-1309-46f4-ae9a-af3b924c9185", "value": "6144:9/6icID7bpnhSQ+3HwOcc0Whu8cYnYDKAqZ/NVsy09ujjb3RNU8Lt2E92iUYW+zu:YWzocc0Wdc2/AQ/71Z3RNtLt2E9UYhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441961, "uuid": "ba7fc5b3-8d3d-4d27-8b3f-94007821ddee", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441961, "uuid": "07d8c56d-8359-402a-bc4c-c7ea79ed5a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441961, "uuid": "08909e96-1d6a-4e33-8b54-74a9a1c78b6c", "value": "BYSM-207 SC TRIFTECH78574543957Baku.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770655bd-260b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633459122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459122, "uuid": "e52775c1-0158-47c3-ae2c-1277f7715eea", "comment": "Malware payload", "value": "4abb343ad1d86e99dd5006c4f2a234ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459122, "uuid": "f4699c5d-95a6-474b-9b99-09668cbac630", "comment": "Malware payload", "value": "19251ffed0e7271c171d150147eaf90cc28187fee3158ecb9c680dabda5a8d5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459122, "uuid": "2b3c0833-87dd-4369-9d0b-24f372c4102a", "comment": "Malware payload", "value": "64658ef865ead0ab9890dadaf62141476b2efafb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459122, "uuid": "5857f546-0a29-4f57-889b-104f7700bd83", "comment": "Malware payload", "value": "47ac25a87962245ea89617b8e2fd4e978dc38429c2d93a695e4839a868381d73315460b29af146b75e102cbe3ee8aebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459122, "uuid": "423cff49-9c54-4fe9-b5fe-29953a6b15ff", "value": "T16324C63EF21FF442D1D4F438E0E1921509AB6D8E3E8C66AA3558E501E57AE987E13F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459122, "uuid": "9a88203c-94dc-49c8-9472-00c310d82495", "value": "d55fbb1ee6639258c4fd415e78d9837c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459122, "uuid": "f34464bb-4632-4b32-815a-533dce933267", "value": "1536:mFJiXp2nzRANDwywG6E0pasdOn99KXXXXXXXXeANsJd/QnrYvR:QnlhG6hhOnrKXXXXXXXXeO2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459122, "uuid": "505e9ff8-381c-4960-a0ef-3d1918f8637d", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459122, "uuid": "2e9852bb-af5f-4fac-bfa3-969bc4284bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459122, "uuid": "5df39f90-caf6-4db2-a28b-89251a39c417", "value": "4abb343ad1d86e99dd5006c4f2a234ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab560188-25b4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633421844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421844, "uuid": "0e737b48-7348-4dc8-ab16-836e50397420", "comment": "Malware payload (AgentTesla)", "value": "1ffccdb7db3b269a43ea31d0952be409", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421844, "uuid": "d40dcffb-421b-48c5-be02-ee1d936d3798", "comment": "Malware payload (AgentTesla)", "value": "1951f20209c829f2b49a23fc2878df3ccb0d69e51cc799e09750f9a5d60b4ffb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421844, "uuid": "ec21cedb-9909-42fe-a008-e9c2b182ee8f", "comment": "Malware payload (AgentTesla)", "value": "388a1b00aff6ad34867f011659461c474b962355", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421844, "uuid": "5ecce2ce-4c79-4df3-96ee-69c7c197230d", "comment": "Malware payload (AgentTesla)", "value": "15ce253bf11609049f64c52bfe2cfad9b8f24f5bd878ac30eab5fcaa23c646eb124c052fb0f46f71ba783377685c5381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421844, "uuid": "b1820266-7e4c-45bd-a926-7a0536d9e0dc", "value": "T1FAB4C098322B1917ED788DF6044CA14153F9DC3B305AF3D98DC2F1FAA6D2BB51AA1543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421844, "uuid": "416274d7-0555-4245-b100-b67728e3cb19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421844, "uuid": "58af3ece-50d3-408f-a7b7-ca2c291d408f", "value": "12288:H66kvc0W3XPhU1f7UPC8eAnnyNQtP/joBjoF:kc0W3XJU5EChnNQ0jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633421844, "uuid": "e9d11d7b-0491-40c0-a37b-153abaea313b", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633421844, "uuid": "24bedaf7-36f6-4bef-8307-065a6c3b0133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421844, "uuid": "df52ef36-69fa-4115-bfc3-fef78a71a642", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e5aaf1-25cb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633431599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431599, "uuid": "10d4b432-81a3-4ae9-8433-39157995a773", "comment": "Malware payload (AgentTesla)", "value": "c67962f854aec0b19968cfee53f34f6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431599, "uuid": "72409302-6c92-44c3-a082-c798909b0949", "comment": "Malware payload (AgentTesla)", "value": "199413444a01d45ee62978ee22ce2a8870f42b1b1923e0ba2944117621ced3a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431599, "uuid": "8dea817a-4b47-469c-a5bf-b9ac8b4bad93", "comment": "Malware payload (AgentTesla)", "value": "6e4b8c36dee3f2b0d6ab0ace3e88fc859703aac3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431599, "uuid": "0e992891-b0b4-4c84-a1dc-1243de335ac3", "comment": "Malware payload (AgentTesla)", "value": "47a61f3e7d5d5c31c295c5ad62a1e3a4010703be74a7f5f0313d00e5cd35b416f84f525d1dfbb5bf60240f52522db97d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431599, "uuid": "963e868b-7f51-41b9-9993-c50684baf5a1", "value": "T1BFC38C0673D4A721C9581AF5C0E7637403F7E68B2772DB8A3D8805DB1E027D8AD89BD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431599, "uuid": "b806e2b2-1681-48db-8f4e-ab569e085072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431599, "uuid": "4c801e09-984d-4c56-8322-9e8cf0226522", "value": "3072:ra9w6bePR+pWlA4z/H+S0h0CTXYmvFMQ4b1LfY:KUQkeS0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633431599, "uuid": "9e057c7a-ddf7-41aa-8d68-11d603afce25", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633431599, "uuid": "a2492aa2-b702-4fb1-8461-effff17e5233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431599, "uuid": "f196e357-2286-452b-877f-ecad8f2977a0", "value": "shipping documents pl_bl_draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89edf9d-25ce-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633433033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433033, "uuid": "c0a9474f-1420-4856-a30c-cd84d653d400", "comment": "Malware payload (AgentTesla)", "value": "0c097024606fe4b8fc16ea7079f8a0e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433033, "uuid": "2aceeb72-5aa0-4cf0-8ae7-f4c2b0c9a8c7", "comment": "Malware payload (AgentTesla)", "value": "1a15ba99c5f61ae52c0196faf9eb3911cbead9631c64c82947c4340bee788898", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433033, "uuid": "133a0d1b-2ab3-48f2-8220-1c4e38536a73", "comment": "Malware payload (AgentTesla)", "value": "70944c8f0c58ccdd9afcc5aef39b1abb1c5fe2a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433033, "uuid": "dbb468b5-6968-48fd-877f-432900a8bb72", "comment": "Malware payload (AgentTesla)", "value": "1effed0ed2663ea996491da7324e731f14b08fb46b222539e3c891d94bc9bd14b5ed9e4b2539ee8186770621f0671e0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433033, "uuid": "29e91d0c-90ad-4dea-8206-0268877b3fe3", "value": "T116E4D6D053CB99C4B57B2639B0222CEBB47D630DF3AECF1151973A938CB9790561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433033, "uuid": "5efe9b25-08f0-4c6c-be2e-ab7220d5bdeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433033, "uuid": "6766f6ff-2ee1-4f9d-bd2f-bf6b4a239169", "value": "12288:oSxI046Mnq0UnsO5lJkKzUvoPUu9Y79THqjaIdkUhM7tnq0brpieO0Bp:LOTHqjpdXMNFnpiR0Bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633433033, "uuid": "05e3fad3-4869-4a05-9189-03eab819c693", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633433033, "uuid": "aedf169a-3101-4916-ba62-37836a60fef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433033, "uuid": "a58225b5-8b81-4a21-9a5d-043b41fb4ea1", "value": "DOC100520021GH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89541a7-25a7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633416363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416363, "uuid": "e1de2c6e-c230-4d22-9ace-72f269e449b9", "comment": "Malware payload", "value": "8231e09f42790139ad909a40d88229b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416363, "uuid": "8f7bf312-7104-4ec8-a905-e927e506f4a9", "comment": "Malware payload", "value": "1ad3f9f666e42833e70912efdc9b973c1b54d714661c0cb508f39a09b3b673de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416363, "uuid": "b4956a93-8651-49ea-ba75-363aa4a2fe0f", "comment": "Malware payload", "value": "881da5d4b46a904d13d859cf1e36989549599902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416363, "uuid": "f9d56ddd-7b45-4cfd-b5ee-238289e55b53", "comment": "Malware payload", "value": "875f8be24b2cac8d4cad360549ac2fc2bc5e83a8648ffc8cd6f72b32dc451f7f5f87a984940e42ff252534b54a58b933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416363, "uuid": "403b5267-7181-40c1-900e-b00207191262", "value": "T151D36B067B869B40C9541AB0C0F7173403F2E6CB6372D6863F8646E61E427D8CED9BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416363, "uuid": "611b3984-06a7-4a99-a020-ec54d214b970", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416363, "uuid": "8796f228-93d3-46b7-a8c6-5b45fcb818f1", "value": "3072:+wxgHaqGJG4CD1lrRyJW2TE1TLkCS0h0CTXYmvFMQ4b1Lfq:+lqG4CDX2QNS0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416363, "uuid": "ab0c47d1-4cf0-4a33-a373-62695e938b01", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416363, "uuid": "585bdd8b-b1b3-4fe1-a470-37d5efda32f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416363, "uuid": "6a01ad92-bf92-49d0-9d8d-69945f7c2d5b", "value": "Purchase order 63287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6238b67-25d4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633435579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435579, "uuid": "0a4f6f89-1c57-43d4-abc4-71c3f3a6bb7d", "comment": "Malware payload (RaccoonStealer)", "value": "c553fba557e7aa0974b59f921ceba201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435579, "uuid": "c8910bae-4787-4f4c-97c4-0a8f70702d58", "comment": "Malware payload (RaccoonStealer)", "value": "1b18ce7b513855676ef76c17fcf6b6d492f20e197fae1090e722b43f7f5ff2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435579, "uuid": "b5607116-61bc-44f7-9eac-fd727250c8c6", "comment": "Malware payload (RaccoonStealer)", "value": "fe2dd09f8cc1ab4efabae2456d3d485f3b17ef6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435579, "uuid": "bdc146c6-9044-415f-983c-37931d9a7044", "comment": "Malware payload (RaccoonStealer)", "value": "856e2c8f7c690c16477a7114bb16147f6204c52a356c26bca3bf69894ff6b582050300950d6a581b88a17c7823dc80d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435579, "uuid": "a0a0be8f-93bc-48b2-86cd-8295a1090e7e", "value": "T1AEF47C33798644F2F47D13F067D58B3249EE2C7B2EE00A5667D83AB985B6360818D35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435579, "uuid": "9ab765e1-729b-4edc-84b6-9f585ef6ef51", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435579, "uuid": "c588f150-8a4d-4e12-a631-234d1671667b", "value": "12288:woQ7Xar2BHs/EIzm/OwD7Hv78Aqg0CLE4xD95mG5izApeI55XCSZTtaN:wZ7Xar2VsBq/OQLqg3F95mjiPdptaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633435579, "uuid": "2e31fb83-c1b9-429d-82de-944c54897269", "value": 766353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633435579, "uuid": "c87de941-6915-487b-a197-a1ba20155058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435579, "uuid": "726f9491-e852-406d-add5-33898047f1a4", "value": "1B18CE7B513855676EF76C17FCF6B6D492F20E197FAE1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79a5965-25bc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633425273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425273, "uuid": "9a67e2f1-851b-4291-b4d3-3016585303e3", "comment": "Malware payload", "value": "4e1166896d3974d70ab9e55d92c45f62", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425273, "uuid": "7414284c-8034-4f6e-8632-9bb56b43bca5", "comment": "Malware payload", "value": "1b4d3eec44b98773cce4790155694bedef6bc80ff0cf9d27e076e026bf8ccbc0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425273, "uuid": "60908b5e-ad87-40e7-94b4-5076b4e2718f", "comment": "Malware payload", "value": "36436bd941fc8cc2aacbb0b28e7b37b6977d852d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425273, "uuid": "f109efd5-4012-4056-9e44-6795311a37c0", "comment": "Malware payload", "value": "868f388770623ec6e60514c5dbd8ee5690a885c58157b28cfd43f5fdd1293f970c531f99df1cf72060aac0c747cad276", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425273, "uuid": "a5fdb5df-aa2f-456c-8fb9-662fe3bf0d3c", "value": "T14414D015E213C89ADB9F47FE7CED4EBA8354370548841639AE3B981C772E2B34C5E815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425273, "uuid": "b2544646-511f-42e4-8be2-a97349fe95c2", "value": "3072:wqpDcB5sVZ80sC8oyv8C7oy7LC+TsD/0OkQ077x8Ps2TpGUv+6aW0ru4+splZJ7:1W5e38lr7mWsD/0FE910xmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425273, "uuid": "547c5a40-333a-4d11-a7f2-f6ad5eaaab34", "value": 193625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425273, "uuid": "f001872c-34f8-4f61-900c-525a0d18fdb9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425273, "uuid": "0286bb5a-82f1-408c-a447-52dd4237d52c", "value": "Invoice.8718.20211004.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b217774-25f4-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633449170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449170, "uuid": "faae450f-8a46-4ccf-b3e6-62ea26b2e3c8", "comment": "Malware payload (NetWire)", "value": "955f90115efd9f0f18a76d4e273564a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449170, "uuid": "8deca0a9-cbb9-48dd-a093-40f8c5050126", "comment": "Malware payload (NetWire)", "value": "1d78b9567fe92c3876cb812060ac76e1225a8d953b50282e5541b03bc984629c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449170, "uuid": "84ea7323-9ecc-433a-92f2-750092ee5936", "comment": "Malware payload (NetWire)", "value": "96121ac45f326d08f4a09e525c13ad3df3dae6ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449170, "uuid": "dc489bb8-8d74-43b5-9847-90658aaddee3", "comment": "Malware payload (NetWire)", "value": "fad955684ca598e0bdffcb7abdb3f0c18e5cc4bfa593467fd53b374572408905f7350243a09640b778ab2a2815e7757e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449170, "uuid": "f799b5a9-6095-430b-88ff-67600aeb4391", "value": "T166056D72E5FE8C37C6A26EB6BC1D51A898043F20341454C719D8AE9C7B747F5AA3A0C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449170, "uuid": "6927962b-4b88-4426-9c9b-a02bc7bddb94", "value": "961dc513b005c9fa212a47cb8687ac19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449170, "uuid": "0ddf5456-706b-4fe9-bbee-3f4f5e966ec8", "value": "12288:zRYwRSGgqDb08Akp0RdhEKmb4Brin4uq89:lTXgqDb08AkyyzbIin4t89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633449170, "uuid": "d7c4135e-e9dc-4d7f-a3f7-40233fc6ce91", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633449170, "uuid": "b1564f38-2dcd-4ce1-8958-588d5c2e9390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449170, "uuid": "11466899-00f2-4e10-b71d-2932a643057a", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbfdff3-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633416637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416637, "uuid": "15d6f2f7-ff5b-4ee3-b5e7-3efef13dfa43", "comment": "Malware payload (SnakeKeylogger)", "value": "6bd6470f1d4307fc7d76d98f2d7e0aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416637, "uuid": "38ceedd8-b38f-4501-ac5b-a64f63879d87", "comment": "Malware payload (SnakeKeylogger)", "value": "1d7cbed41fbf3a7948b941f7a633d8f05a263828e1f38104186a764292638133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416637, "uuid": "b8b55304-3dc1-4639-910b-3ca7bb118eb2", "comment": "Malware payload (SnakeKeylogger)", "value": "1e920e16be0cca301799a3e91df593ceff6e704b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416637, "uuid": "2fbebae2-be57-4000-b157-31c27bb55dc0", "comment": "Malware payload (SnakeKeylogger)", "value": "9195167864d720cd20b2500b962694335d03602b052346b4c6b9449e52a30c65af3da245de8e55832744c93947885331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416637, "uuid": "392cbfe1-b0f4-459f-8de4-522d1ce0405b", "value": "T1E9C429AC321371FECDD7C1B58A586D60AB14646F530B82135037DDA9B93FAA6CF5C0A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416637, "uuid": "a307df4f-b077-459c-937e-9510b34d7148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416637, "uuid": "16201f8a-747c-4142-86c4-65f7cfc51883", "value": "12288:2pvLxlTt+YAudElYXX88s6I7miEnt5jItqo0J7:0vLvTyK8ehB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416637, "uuid": "12051379-78e6-4d5a-84ff-d69ce517ad10", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416637, "uuid": "25ebb50b-9c60-499e-bc15-110707c69ba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416637, "uuid": "26f39e97-dc10-4cf7-9dbe-863964457171", "value": "Purchase Order No. GN-205603-004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc53b08a-25c6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633429630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429630, "uuid": "c6478c2f-9cd1-4c35-9cd9-e4ecad5f8527", "comment": "Malware payload (AgentTesla)", "value": "3a1097e4577bf7864a6709b952ebbc2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429630, "uuid": "95fae723-bc7e-4399-9e38-9df0feed831d", "comment": "Malware payload (AgentTesla)", "value": "1e48e299caf273c82056596b13ee00c8cbd1ecbf4ae100ad1ba8d71a5a226007", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429630, "uuid": "c2ddaad7-1d61-40e4-aac8-f1bba25f4003", "comment": "Malware payload (AgentTesla)", "value": "c68d172ac9cc99169f16523dc026b979aef498be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429630, "uuid": "65d163ac-99c6-4f65-93b3-2583e39a97d7", "comment": "Malware payload (AgentTesla)", "value": "2340889ce569e9c815f05f61bebe92f0300b6c2b2fc52ee59f7668a0dbf0be5b43fc04fc3a7ae18b2930ab0450551503", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429630, "uuid": "df67da0c-cd2c-45d4-9e03-9d4670d32348", "value": "T17FB4CF9433AB6F46DD798FF4151C919293BABC3B1079D7690ED1B0EE1E21FB00A90A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429630, "uuid": "935b1095-b017-4854-bb2b-10bddde136f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429630, "uuid": "cff22b08-4b93-4136-a281-e00954a36501", "value": "12288:hfsocc0WhhmU1OmCnvra0G0iXNONKiHt9Ef7yfhn:Jsrc0WhUfVnvA0iXEK8jEf78hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633429630, "uuid": "a2c15c4d-2dfe-40f6-b136-95c3a30bdb7d", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633429630, "uuid": "38f9e10f-a474-4a61-b97c-82338cf75012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429630, "uuid": "3b4283ba-51c2-4d79-8d3c-5650e9d62fb9", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b57104-25a1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633413695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413695, "uuid": "e3e46445-0104-4ce7-ba94-d722734414eb", "comment": "Malware payload (RaccoonStealer)", "value": "a33039f06bcfc8cca0c615c1c35cdb0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413695, "uuid": "dc8006ac-5ee6-4186-a19c-0271b4ec1636", "comment": "Malware payload (RaccoonStealer)", "value": "1f3057ef0ac66ca277f6e443be3547e4db15b989ef0874b2a0770caa8441dafd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413695, "uuid": "79853d21-bd54-492d-b727-fae8064edd2b", "comment": "Malware payload (RaccoonStealer)", "value": "5ef5da9ec976e147e3c424596148ee5cec71bdc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413695, "uuid": "7d3f1ea2-dd8e-4f09-ba53-baeedca5281d", "comment": "Malware payload (RaccoonStealer)", "value": "f96a913495771a6f26eece3b4ddb3b40fcfde3dfd285d4a3b615d9d949f5036edc4d974ce1d3de106fa1aa3f26346e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413695, "uuid": "489c9610-6dde-4cdc-ab04-e866ca503494", "value": "T196449D30B7E0C035F1B752F549B993B8A92D7EB19B3490CB53E116EA5634AE4AC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413695, "uuid": "55cdb840-f299-4ac3-be16-301f2eae950e", "value": "7d2b5fe056f9f1898f2b12424a66461a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413695, "uuid": "0bc375b6-a15d-4c64-b52e-55d194731d64", "value": "6144:KoBoij1atV0Zx1aC5UPW7fuMoFKVgj7z:KoV8taZx9UO7flC3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413695, "uuid": "f5bb5fb9-868a-4776-9d61-3e2ab5ffb162", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413695, "uuid": "f015df7b-70ba-44eb-8b75-b57f45668d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413695, "uuid": "df8b6300-f1ff-477a-99ed-520a0f952012", "value": "a33039f06bcfc8cca0c615c1c35cdb0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d4acf0-262a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633472268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472268, "uuid": "4b508e40-f181-4f09-9ea6-ca06aa54b20d", "comment": "Malware payload", "value": "818b7d18eaa75ffb98af04cf9e2c192b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472268, "uuid": "f8d2c7ea-417f-42e2-aa87-31bb6cea1fa5", "comment": "Malware payload", "value": "207b17cfef7a24b2c2d48f9821a9b4a82caa00fd8157d70072c999f8ac7f7489", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472268, "uuid": "0ca0c698-dfa5-4d6c-a726-afb4e97e4cfd", "comment": "Malware payload", "value": "44162a27be1745ca41c282333f9fd8e36ef9bcd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472268, "uuid": "0c1a3bde-5909-4a97-8117-80d0783f758e", "comment": "Malware payload", "value": "cbad90bc16e51323fb062acafed19e892773be9e28a937141b3a012e77d6bab41d496cd2558cabbb314c4242b21951e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472268, "uuid": "10930246-f508-43e0-a211-f6a358badd20", "value": "T12AA4F04CA3235646CC2B83F05844DBB25B796C22126AC7390BD8BCEF3B67BB41ED0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472268, "uuid": "893b784c-cebb-4e23-99a1-c8393d6bf30e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472268, "uuid": "000d4c2c-f670-42b7-9c9b-9bd25a903946", "value": "12288:nnSoj9XKj/VSSxcHujyBshhD45jHEcwBC1bI:nnSwXKMSCRWjDtcwBC1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633472268, "uuid": "fab7ca25-ef26-49a1-86ce-987002f0c86d", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633472268, "uuid": "c12adba7-52d9-4730-84c6-0a577f7f33f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472268, "uuid": "e8f9cb26-e8fd-4f92-a6d7-33f351d5dc11", "value": "New Order 490257901.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4db561-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633437250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437250, "uuid": "e26e7062-acd2-463d-bf78-6766d127cb5d", "comment": "Malware payload (Formbook)", "value": "3bd9315fa824d7f8351d858ca5c12629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437250, "uuid": "dcf81c11-c7c3-4d15-a88c-2ae7a554a957", "comment": "Malware payload (Formbook)", "value": "20fd96b00deec9d95d0e251aa4c6885f85af415f8e776716399b4280ae8128f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437250, "uuid": "f069695c-2861-4fef-b0f8-2f61e658cdae", "comment": "Malware payload (Formbook)", "value": "a19b2e80a240452e4fe251a9299bd5d30b66d709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437250, "uuid": "0ba4ce42-340d-473c-b565-c7cf75e46023", "comment": "Malware payload (Formbook)", "value": "1f3b82aa091ea3640232466414c18ce76609d10016b9b1da0e1ae1e3c83b3b20a135c1621bb7d7e660e96d37bd460ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437250, "uuid": "bb8c9d97-30c3-44b4-9692-69d435a410a7", "value": "T1BDB4C0A433AFAF45ED348FF4181C919297B67C3B5179D36A0ED1B0EA2932B700A50B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437250, "uuid": "91703973-5119-4d54-821b-068c69ecd6cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437250, "uuid": "e06632b8-305f-40a2-a6a0-75e974fcbc4e", "value": "6144:Gbx0cXjCfjnhWQ+3HwOcc0WXJ4+5yk6kPFlom3iBX94AcGFCKrvvScZTHvxqVCHR:QOFPocc0WX64kmiqAcGXFZbAAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437250, "uuid": "e3cb8f90-3053-421a-b27a-b4df681251cc", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437250, "uuid": "dc73fd2e-0a76-42f7-acd3-c0d6e273fba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437250, "uuid": "72f72ec3-f4e2-444f-8f68-5e7e230ade50", "value": "Confirmation de commande # 4905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff7fcf9-25b5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633422093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422093, "uuid": "6fc8a08c-bed2-4361-9b13-01794de8e923", "comment": "Malware payload (Formbook)", "value": "d41f65d9b8b141d40387320ce54f9ac3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422093, "uuid": "6000be34-da3e-4ddd-9eef-eb30dee65e1d", "comment": "Malware payload (Formbook)", "value": "21350c749a15b06efda33cae533086eab02ef83685d539556407633676de94bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422093, "uuid": "8091f24f-84a0-457b-8a9c-fae2ef7423eb", "comment": "Malware payload (Formbook)", "value": "33fea576d37736131811f5c528aa6439ca53ed95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422093, "uuid": "922c9e99-a96c-490c-aeb3-aa87e4f67c88", "comment": "Malware payload (Formbook)", "value": "e1d1a8c9eeb745d6a1617e9284744a6b1988fa6375e9e98873c925870c701ae6699514203a394b4e30d38f5f55b00e88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422093, "uuid": "fbe13cbb-33f1-4905-a1fc-c0881f32dbd9", "value": "T1245423A7BBC184F7F5A669304E71D6B8F333E21984141743CB584D7E7E792858F08626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422093, "uuid": "a622aaad-467a-4382-8895-b134066e3283", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422093, "uuid": "c466e376-63c1-4cb8-9fce-0aea903b5f0a", "value": "6144:F8LxBs3nJrv0zlkc8PbinRR2Nciu3WcHcdu9FYlIRVFAyC7RoCadesoWqJJ:/XJr85mPbWiu39uRIRcHFxxvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422093, "uuid": "ceb0b5e4-2868-4b84-b17e-62be970807ab", "value": 305857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422093, "uuid": "070532a9-544a-4692-8ef7-1114213b5e25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422093, "uuid": "3b19108a-c63b-4cc4-9d8e-7255aea20151", "value": "d41f65d9b8b141d40387320ce54f9ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82036ace-25c2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633427787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427787, "uuid": "04332bc6-58e1-4c0c-9a7f-8f04d17e0bb0", "comment": "Malware payload (AgentTesla)", "value": "b64bef8b818b4d6b18c113c83c63dc22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427787, "uuid": "b8948ec4-f6be-4d70-8986-d14287f1f4c2", "comment": "Malware payload (AgentTesla)", "value": "21cd29baa56cc9d6a16ded73828c7846e1c8ab08b7a465d471cb10c70f7c4d9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427787, "uuid": "5977a734-b8a0-4283-aa89-0a740c194de9", "comment": "Malware payload (AgentTesla)", "value": "3af7a05513a6a53a051fa50622d5fc8dc6e4bbeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427787, "uuid": "cf63726d-3f7a-41cd-aff5-92aa137a9537", "comment": "Malware payload (AgentTesla)", "value": "dbd046f39c57cc457a1216d874cc96505b629ab7633ae2cdc82395ae65b6409b5ac5a81443fa62bc20fa2a4def3a7fdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427787, "uuid": "99de439e-01a6-47e5-bfbf-a96238eb4b48", "value": "T1C9C4F17CC7634A16CE788BF73918965107F691A882CAE3BC1DC4F4E93D63BB9946041B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427787, "uuid": "c1543efd-01ee-4a22-9b3a-e663c9c3bd57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427787, "uuid": "d76b1f91-b756-44d7-b2ec-e64cbda5fdda", "value": "12288:+vCIoay8gTGPxEW7MZKnuIpmcd3drODeggy9NDN8w:+KIdCeS/MuAXCvgip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633427787, "uuid": "3bbb9697-880d-4fc3-9b38-028dc95ca0e0", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633427787, "uuid": "af8526cf-c460-4392-98be-034d56be265a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427787, "uuid": "cc0be992-0f69-4bf4-8313-20fb19656062", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f687824-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633441983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441983, "uuid": "1d799a4e-872e-480c-9b28-3cc336e5ede9", "comment": "Malware payload (Formbook)", "value": "486990b975aa0c60bdbc054ae6a2b3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441983, "uuid": "1c671e0f-5a72-400b-909c-2ad7b10103f1", "comment": "Malware payload (Formbook)", "value": "222c8a0ce49171c3bb93631e7001bb152ad05fa4ba13437a173f1d0dd9fd0a4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441983, "uuid": "549db81e-ae66-45f4-ac85-b013ecbfebfa", "comment": "Malware payload (Formbook)", "value": "9806f58700e62c3de83536edb99fd66aa1c01d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441983, "uuid": "d8e19a41-d2c6-49b8-a18c-8a320d40455a", "comment": "Malware payload (Formbook)", "value": "800f0a4b3bae8d1d31794b66c52bf9bfc21d0c4551ce6653f45b5d2d9db42c5529b43820d99f7071ae055289f563e60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441983, "uuid": "84e7bacc-3430-490d-aa6a-21914a17a772", "value": "T1D164231717C082B7ECE311F94B77BA55B7BB900860626C134F409F6F366469B8E4B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441983, "uuid": "d1f9e848-8f9b-4e8e-8e2d-75529d304343", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441983, "uuid": "075cb72b-344b-4ea3-9497-1a0e7d92ca7d", "value": "6144:F8LxBsKs+75CWWdAU/Jh16P2b3mXTPrAtegomnP8Rl:/N8vOAU/C2boD+PxnMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441983, "uuid": "f8dc74af-db1b-43bb-9fd5-a55e3a2f30d3", "value": 306658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441983, "uuid": "4f13bd41-3f0f-43f7-afe8-e17a710db137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441983, "uuid": "c7699d23-114e-4e5d-a224-0dcb11f35709", "value": "RFQ54488203expediere_doc202177,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52431e11-260d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633459919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459919, "uuid": "7f471c46-0d78-4053-9ee0-8be3f54d8d1b", "comment": "Malware payload", "value": "c327de352e8d2d8efcde4158619cc68b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459919, "uuid": "dcc1cd66-6280-4373-a921-bc6a6f33d0d9", "comment": "Malware payload", "value": "22a33d21d0bcf24632a2d43ce532bdaaca8f36a654820ae62caee91ee16e3f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459919, "uuid": "bfa80c1f-8de8-4e9c-839e-ba6713a0ff21", "comment": "Malware payload", "value": "b35f13266c22cfa4af5d896e71ffc03c065680af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459919, "uuid": "04475fb4-c05c-484c-82f4-5ccedc0430e5", "comment": "Malware payload", "value": "99814b83108fb30b1b46de1b901be7f3be53dbbf0c1c5aa187c9362c382a1eebc9aec87e999ae1efd5199b10920a1d74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459919, "uuid": "b0c2f395-07c5-4505-825d-8145bf1d656a", "value": "T1F883099D721072DFC857C472DEA82DA8EB64687B871B8217E02716ADDE0D897CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459919, "uuid": "090c7cfd-5fe8-40d2-9b36-b027adbd2f81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459919, "uuid": "d04bbce9-b55a-425b-9d72-aad7952c8d38", "value": "1536:lRWeJ1BZBziUoNehav2A7mhIqiyUhBFvpqcylbMGRP1:z/J1JziHNeMOwIs3dQHlbMGRP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459919, "uuid": "3ea5bc20-c3ef-4d23-8621-f05a44d7b5eb", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459919, "uuid": "b97c4509-d9fc-4e36-8707-e1861c21a20b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459919, "uuid": "2bc226ac-edd7-45a7-9574-22f4e935c6c5", "value": "c327de352e8d2d8efcde4158619cc68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b3b62b-25ce-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633432761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432761, "uuid": "fc3e9694-99de-4f5a-8344-bc99ff193a79", "comment": "Malware payload (AgentTesla)", "value": "dbb53a8dae4f27476b4f30dd484d5ed1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432761, "uuid": "b072a30f-8aa4-4816-8c7c-b262cf20d3c4", "comment": "Malware payload (AgentTesla)", "value": "22cbdd366f415e2358fd19df497523820f9f0c2465147baac55673c38841f279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432761, "uuid": "0b9a73d6-7518-4a90-9ec4-5a299c92364b", "comment": "Malware payload (AgentTesla)", "value": "acfcae2d1cc9c1a30394eb52afb449f998ae3101", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432761, "uuid": "e5e0f4d1-b7d1-470b-b5de-c6704b4891e5", "comment": "Malware payload (AgentTesla)", "value": "29e178e2a4f7ed444fcff2abfc2527db05787cf65d8acde6100a8273b3945fa22c3cd8fd7e9909d8313eee31515ecb6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432761, "uuid": "320df625-e414-4d3b-9f8b-e8ae2777a4d6", "value": "T132525EFD969C1013E21BC866F86DBD2507B7F1ABC6CA8655737DDD301BB36220B51405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432761, "uuid": "c6ee892d-f9fc-46f4-b262-4f9a92e4fc3c", "value": "192:wiRznh77+NlE9CRc2jmrQmZIXT/91B+QxUrLCiPiMqXyTddphYUlcd:wiRbB7WyS/mM4IXAqMqX8fhYAcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432761, "uuid": "68b2cd87-7366-4ffc-b152-9b97f9a1f273", "value": 14067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432761, "uuid": "2d9f9088-6f79-42dd-8330-215421b78a5f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432761, "uuid": "fb89a5a9-98fe-47a6-9fda-c413e39d66a7", "value": "Payment_Advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30197d7-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412085, "uuid": "76e68efa-d152-49aa-ab29-7b3cd3db0ed2", "comment": "Malware payload (Gafgyt)", "value": "f3eb1fa8d486b26ef2822f9659711b78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412085, "uuid": "4630547e-97bf-49b7-ad60-90c9a9c601e0", "comment": "Malware payload (Gafgyt)", "value": "22ff6eeea1b6299314863e46e4b0939e787dc05092d98f20eafbafc891304b0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412085, "uuid": "4332df2d-33b2-4c20-9e23-06b62ff192c2", "comment": "Malware payload (Gafgyt)", "value": "97162d04d4cc67b32b1c5165c9fe27f7a819697e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412085, "uuid": "3781f8b1-c931-457b-8a7a-85c30eda4278", "comment": "Malware payload (Gafgyt)", "value": "499544af4a5d5ea22bce86dd5931ca983c0b744d154f92808dc080cfe0a95a334473f92d9dab6dcc704c376b11f031b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412085, "uuid": "c33bb69f-5b50-48ff-8ef4-605afae6e490", "value": "T159833C0399A29FB7C0866EB526B749300713F8115F1B2B9A7138AEF4464F9CE781F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412085, "uuid": "07997fe1-1128-400c-bfa7-1f97b575b154", "value": "1536:7ViQZKIrylmB94C4De8CRFESUmj0VqYLeRR/gQ:J/gITB9z8GF2mj0VqYqRR/gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412085, "uuid": "a51bda4a-2fd8-41de-883e-8d02d511a861", "value": 81333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412085, "uuid": "15d1a3c1-a9ef-4b5f-80aa-02da701b5f20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412085, "uuid": "4691906e-2049-4d24-b9c8-b1ede1c0fada", "value": "f3eb1fa8d486b26ef2822f9659711b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a2c1b7-2633-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633476355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633476355, "uuid": "1c68cab8-baa7-46ce-95df-e90ca7b62f3f", "comment": "Malware payload", "value": "690e90649f10823c38af473639e7759e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633476355, "uuid": "879e1b8c-bd19-4178-9d2c-fba443199bce", "comment": "Malware payload", "value": "231d6a2cadc26a70f5663ef666e8a0700946d10e9f845b1c11273b3ab3638611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633476355, "uuid": "e0e3434a-3bae-48da-b0f2-d1891dddb8c2", "comment": "Malware payload", "value": "c706de5a9678454f2475f44f105d0b24f098959a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633476355, "uuid": "f61b93fd-a6e6-455e-ac7b-c8b5acba58a5", "comment": "Malware payload", "value": "9fe30be4d12655af5cde98efa27810a03dc5d9fb1d3f69eb27a135fcc0a613768df7f06ec410a772ee44ebd8b88dd933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633476355, "uuid": "b7414a59-79cb-415c-a9ee-9a5784b4f57b", "value": "T161C34A50B2E09848F2A50A71C97AD5B40BE7FC5D9D13C70B2DC5394E3B7AB089B167E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633476355, "uuid": "70357026-8707-4c36-9e0a-f67f5eff4646", "value": "461dc836626597933929a467ef09b568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633476355, "uuid": "26769d2e-add8-4ed4-8721-6821b5068961", "value": "1536:4H6WfDWPCIk2I+kHd0yGStvJVDh6Qfa9L7gSG2peE4n3GpaBDs3:4H6WaCAm0yGSDVDhfi1vjW3GpaBDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633476355, "uuid": "8b83ff10-d318-4763-999b-c2d7d319d145", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633476355, "uuid": "82c6fdd4-4001-492d-83ea-c2922933cc74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633476355, "uuid": "3a6b3d2c-aae4-4b5d-8226-170cc2fd2f07", "value": "New Order 789230032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc93252f-25a6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633415967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415967, "uuid": "ae60927a-f175-4908-8768-94f05f3e0314", "comment": "Malware payload (AgentTesla)", "value": "835b5a479b1a3d79bdc5dfb9f0977528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415967, "uuid": "9e5827a1-7dbc-4a8f-ad7c-c218f4123c9e", "comment": "Malware payload (AgentTesla)", "value": "233f51c7c9403c15afd02a1b6680b757ed8c6e27527835de82336c7c3684d801", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415967, "uuid": "2aa14bba-f746-495e-945c-4f0f61a426bd", "comment": "Malware payload (AgentTesla)", "value": "4acdffd964a786e5e0a5f1e49818b1d23831a18f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415967, "uuid": "b9329e4d-176e-4e65-89c5-6982b5188de1", "comment": "Malware payload (AgentTesla)", "value": "842a0b01936ca10c7ba4b8e1790077a0dbd570af97a9b89bfd9b9342b3e9f91ce9e6fb033e125473a9e97b195ddf5ea6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415967, "uuid": "88f99f46-f89b-4c7f-8758-72c638ea394e", "value": "T12D948D50F1C9D4B1E8530A774879D83111BBFE7D987A4A5F268E361D0AF3382216AF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415967, "uuid": "46cb924a-c67b-4626-9931-e73d4912a8a8", "value": "337cc3ba01595b56bed66bb7d8f07a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415967, "uuid": "4083b279-7b98-4756-a523-9336dcb217e2", "value": "6144:sURdknhrVY3x1UTQGlLFGQPftsiRXQ6rkIaj/HA6e:sOWhrVQxIbvPft1lEIazA6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415967, "uuid": "862df24a-c589-4e22-911c-70ce7c87a380", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415967, "uuid": "242167e3-e476-4702-a5ab-2f4b56fdd63e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415967, "uuid": "d992bbe5-8622-4782-9999-328d0dca1e0d", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab34dd05-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633437305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437305, "uuid": "cd7112ca-3158-4594-b67d-dd630d695305", "comment": "Malware payload (AveMariaRAT)", "value": "3ae089494d820c514ba135503b99d51d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437305, "uuid": "1dc14b9c-26f1-4cf6-b436-54f84f0b9da9", "comment": "Malware payload (AveMariaRAT)", "value": "23f74981d40afa04ca66f227ddaf65e1bdd7e90fcec4a25a1e9c58ef240fd03c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437305, "uuid": "7fde08ff-f890-4b79-b2ed-1ba71744261e", "comment": "Malware payload (AveMariaRAT)", "value": "681700e012a038c356dbf8f052c64abb206e9aa5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437305, "uuid": "b0dffbad-3bbd-458b-93a4-6b0710ee3ade", "comment": "Malware payload (AveMariaRAT)", "value": "1f0bfebe1fff1da55abff660160700b5aedc612221c0b2788f88326a665f772ac57e81947c56f83cff18439b10cd8d60", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437305, "uuid": "ac249aad-fcef-4d63-bc35-a7adddf3b4aa", "value": "T11DA557F0AD01D4C1F5BE5B6AF2FD3A48A1343217EBC94A4A00E7E5551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437305, "uuid": "cd0c68b8-39f0-4934-801b-e1876a2a4c5f", "value": "12288:trG2Xti+aqCk0jGjVB2LwK+lMP+LfJy+GY+psPN8Qrzzk5vsA+:pG2XAffPO21KNLhnoGPN8Qrzzk50A+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437305, "uuid": "fbc73be5-a571-4eee-9838-63976f69d71e", "value": 2062772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437305, "uuid": "ce4c1efb-a98c-41e7-97e6-ff94299feb1a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437305, "uuid": "c973223f-6ed1-4c6e-883e-b8085065c71f", "value": "DHL_AWB_INV_PL_BL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85061c0-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633440871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440871, "uuid": "3ae9e9c0-6954-40a5-843f-74b269c339d1", "comment": "Malware payload", "value": "4704fa0ae90052fe35cd15ad6ae5d6b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440871, "uuid": "37b22885-fa6e-4b59-9982-f771f4d991e0", "comment": "Malware payload", "value": "24bb593adac8466351328d0961853ab9f2c59c8bc7f437c5759ea8f537646e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440871, "uuid": "36d55089-9f18-4300-befe-da0a42554217", "comment": "Malware payload", "value": "3638386cca8c6b7c578df2e0329fcaf68ddfb6d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440871, "uuid": "51e264ee-d625-44a7-8e96-df08f59ade61", "comment": "Malware payload", "value": "f59d3bc07aa06ba23506490ef88c197c3fde836f499e15d9e4051f2f95c688539ba2bf1c810275e5613751fad76d4e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440871, "uuid": "36311859-ccdb-4d87-9f0a-6dcc815eb9ac", "value": "T17E16013262E50E00E9505F7253C59B24D1737DB257ABA3AE321D342E7F75BA22DA1338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440871, "uuid": "c36a12ec-3b84-4fce-a84a-964cf9703e27", "value": "48f3d5e4015aa42125d3c07e0f131c99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440871, "uuid": "ec9c174b-1290-4911-bfe1-02f2b8b9461d", "value": "98304:FUvCYQVQufh10jZ1ribRmnhmJmsSQhzSSBlbSSClUzzOslBxB/BmpmJpPHmvomhA:F7VQufh10jZ1ribRmnhmJmsSQhzSSBlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440871, "uuid": "e9cef7ba-6dba-43f5-a0db-f135bae79a13", "value": 4251648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440871, "uuid": "11d3bc90-485a-411e-bcc8-8ff871eaf0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440871, "uuid": "b99d4442-d55c-49a1-866a-c0a926bf7504", "value": "view ur pay.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768c89e7-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633440653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440653, "uuid": "3c465b03-e735-4164-8e6f-395554972a1c", "comment": "Malware payload (Loki)", "value": "5e200ea00712e00ec09695bd544e953d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440653, "uuid": "ab81be91-c7e5-4b3e-8bbe-0cee11eb816c", "comment": "Malware payload (Loki)", "value": "24c6a7b971c8f897b96e7ad8034b659b7e0d0606a462ff96824bcc9984594851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440653, "uuid": "8e40a7e4-62f2-4fb3-9ac4-e71c029982d5", "comment": "Malware payload (Loki)", "value": "1ac9a14036121656711d1812a8591216a3ce3174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440653, "uuid": "ec9a658e-82ba-4bc4-bd1c-303c49fb6580", "comment": "Malware payload (Loki)", "value": "d0ccc870f766c30639518ed784e0ae2dd4f255635ad7c45bd126f4596068a4099fce0351eedab2674abb28ca4f4925e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440653, "uuid": "9f7ffe3c-b9d4-48e7-b078-2183f072aa4c", "value": "T18694F1153781F2EBC4D1A6F04D2AC3B5B3B1BF141B822787765577AE6E71222CB06788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440653, "uuid": "dd2f7222-4edc-4e01-9b13-4a835cfe86fe", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440653, "uuid": "36f8caca-46da-4bb3-950e-5d6de7b5c50a", "value": "6144:68LxBshHLgUr9vqEWN8ca/W/ebYDVzYcC/UBij7Zi6SXRYn+dpVT2:ihjrJBWI/YvVzYcCsBig6SXR3dn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440653, "uuid": "05442beb-8946-49f5-b0e0-60088a7a3c77", "value": 423350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440653, "uuid": "050169e3-a672-423f-8a4c-c1187287ad6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440653, "uuid": "0b05b529-3a2a-4175-8b5e-bc9063cc4f4e", "value": "RFQ_final version 2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ea4ec6-25cb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633431652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431652, "uuid": "4e3a7916-331f-47f9-a35e-6aaa80d45ebe", "comment": "Malware payload (AgentTesla)", "value": "5c6e4580af8352606e9465f0ee0f405c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431652, "uuid": "f9a21ba6-3fd5-4f51-ab91-26edcb36c67e", "comment": "Malware payload (AgentTesla)", "value": "24ee80720ba9d803a90dc9cc76b30d97dbd4a4e68e0b764d3c22e2da43a0ef4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431652, "uuid": "4f685127-a743-4e36-a7e7-111d1c29f0ce", "comment": "Malware payload (AgentTesla)", "value": "3c3d7db9afc84f2ad6d8a6c74d2dc336a0a7c04f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431652, "uuid": "cbc2f4df-71a6-4c35-9d4d-25f4d6050dfa", "comment": "Malware payload (AgentTesla)", "value": "7b8203f22565e5db0038895d6d2526150778d98d6dae5ee84f3e43534a4e9e3b8f4ed70c74317b6d73ef2473b830cac0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431652, "uuid": "0cd6aec2-30ab-4175-b1b5-88bcbd18d3f3", "value": "T17915C5D43386B5CDF537D239F4111CEAF9B8311EE31A8A02A0272AD68D6C641EF2D5D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431652, "uuid": "9c91f1cc-364b-44b6-8f83-40b2b0350624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431652, "uuid": "e1cb2d6c-5716-42cd-ab5d-f368dccc6566", "value": "12288:tV3c4tiu36qdoNtFx046Mnq0UnsO5lJkKzUvoPUu9Y4YKOs1BH61djtWCOkqL6Es:L3cMNMTTqL6E0zUz30Vw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633431652, "uuid": "8d407911-ffae-446f-9cf2-e108efe2771e", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633431652, "uuid": "477b5dab-4989-482f-8537-d381f1a4ae38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431652, "uuid": "ec9b6c2f-7b44-435d-86f2-5a1a6faf786d", "value": "HB1nqaOkjp1KD4T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367fc70d-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633413058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413058, "uuid": "d069ad54-43e6-4b7f-8fd8-874ea78afe38", "comment": "Malware payload (RaccoonStealer)", "value": "24ef516b6eef6d2c7a2f212303980882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413058, "uuid": "d087c6a0-b823-4c9d-b14c-63f2fa672352", "comment": "Malware payload (RaccoonStealer)", "value": "25e8fb609f633e1130c0d344cdc6def1deade9ef0502f7a56a17c13dbfd0df00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413058, "uuid": "60dcecbc-8703-4882-ad7d-fec326370c76", "comment": "Malware payload (RaccoonStealer)", "value": "bd0e58daa18cc6cd1eed0535c0db04d53fd6085d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413058, "uuid": "5f0bceca-61d0-4483-a2c7-9e941a9998c8", "comment": "Malware payload (RaccoonStealer)", "value": "f6d39ad0b54ca18d22634ab5f1e5e10ff7a08eb3d6d71e1b7739b7215ddd67b2fdb74ca333f25ced00e2cc6dc82f3237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413058, "uuid": "280b50ce-c7e1-47f6-abbf-8587766375a9", "value": "T13EB4E030B7A0C035F5B792F50AF593B8A92D7E71AB3490CF52D11AEA56286E49C303D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413058, "uuid": "807281b2-d61f-45f1-a361-407404bc72e8", "value": "7d2b5fe056f9f1898f2b12424a66461a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413058, "uuid": "be40bd9e-da4b-4f01-b999-a68ce5051060", "value": "12288:Fa28kc3j6xlh+C/1pWGcJMnmhUTcwDEL4EsjY44g6/j:nej6XUU0GcQmhoRDEws5h/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413058, "uuid": "a9313187-7baf-4cc2-a810-da3dce63898d", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413058, "uuid": "df3fb998-8e5e-4d04-aa6c-3e64d12d45a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413058, "uuid": "e5352db7-5941-4a6c-a7f5-8af5663226fc", "value": "24ef516b6eef6d2c7a2f212303980882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e143f9-25e7-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633443521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443521, "uuid": "9508ef40-9932-4f5d-86ef-d46eea91452b", "comment": "Malware payload (GuLoader)", "value": "64e1825370ad3e9eb2f9bb471943b50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443521, "uuid": "f26e1219-bced-4ba8-aacf-d6992c31dd2a", "comment": "Malware payload (GuLoader)", "value": "262a3fa456716a64297fc16e7cbff0a0195616d2b9fb98c230f10888ce76f6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443521, "uuid": "bd0f6178-d479-4328-b95a-d887607abf50", "comment": "Malware payload (GuLoader)", "value": "f211ec760c38938a803753af11c3df8cef13513c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443521, "uuid": "5a2b3edf-88a2-47b3-b973-afcd2e4b4267", "comment": "Malware payload (GuLoader)", "value": "5c6a5b7013f107bab038b73cae92ff567184516363e8eb7c54e14ea3b47fd5c6e52308a2f27687a89a870f621a567183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443521, "uuid": "651532df-4f26-4578-b937-f4b154320f9e", "value": "T118C37C577E045C26E1B2CD7728B9C668550EEC11F36A0E1F686A7F08F8332D238E695D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443521, "uuid": "0e8d7311-576d-4d38-b397-0363d9ff9bf4", "value": "1eb3a7317bca1c3a71a2a06454a2aa39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443521, "uuid": "614d2f98-e370-4398-a2c3-90c85532dd1f", "value": "1536:cIWSptrOFEKUV9XTQ8AeL3W7eWqXPWnIHLK5jdoU88JEX6RSGdD:cITrOuV9M8AeLUqfU8sy6RSGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443521, "uuid": "e0beb405-537b-4fbc-94f6-972e658eafe9", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443521, "uuid": "70cf5938-d6b2-4cc7-a4d8-ec2aacb1db6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443521, "uuid": "cbdc2144-1f4f-46ce-a57c-0cf7dc385e61", "value": "doc03949873800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4780bf6-2599-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633410236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410236, "uuid": "1bba1b2a-bb1c-41c7-ba54-cb25751be33c", "comment": "Malware payload", "value": "af5d530b8fba75dd99ef7798e3023150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410236, "uuid": "daac1b77-8a8c-4b6c-8c1f-f637734f2664", "comment": "Malware payload", "value": "264bf0d20eed25b06d7e3cd940c1228a37818cbec9f8493689e9964c8b4a9167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410236, "uuid": "94fdaa4c-031d-4761-ae68-50b7df8d7648", "comment": "Malware payload", "value": "9d8b53caf028622b96d2c9bfff6fcec12ccd5b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410236, "uuid": "481c9024-6f5b-4d2b-91f5-603e17f61e8c", "comment": "Malware payload", "value": "4074ba15b6508d3101f8a8682e6fc2e82826f79dc5ea56d7fce94b24ab48757810b5385bbf8488bd78c53e80e0b2fc61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410236, "uuid": "034034b9-bdf9-4c4e-ac65-8f4b3b95aded", "value": "T1DE759E223AD18037C27B7535864EE37DF6AAE970AE35424726911E397F34442AA3C71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410236, "uuid": "b21a4c3f-b3bc-4472-85dd-979404d209a0", "value": "abebef930d10d21593f956f757ea26a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410236, "uuid": "527932dd-b3de-4152-a43d-431508603bcb", "value": "49152:F0+xdJwyeVWyV+9D1fEL+jC1ohCyEDdIsY1ZiPU5:FrJzeYyV+9D1fVjGohEDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410236, "uuid": "a4780fc6-bdbd-4dcb-b5f5-4e378863fa38", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410236, "uuid": "f79830be-a0f1-4cd7-a0aa-6491d7c448c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410236, "uuid": "5b434cd3-8ea2-4ed9-8a38-ef26010f3528", "value": "nrkw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2625a72-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633437317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437317, "uuid": "ff50e572-a7c1-4193-91b9-eeaa91c3d001", "comment": "Malware payload (SnakeKeylogger)", "value": "5ffb52dc757e585a056c04ece789ced9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437317, "uuid": "83e6b663-6a4f-4486-9e7d-983f32da1ce8", "comment": "Malware payload (SnakeKeylogger)", "value": "2654a8d2fc98521be454bcdfad7ae5d376b9a4c522814dbd37aaf27b1955b4b0", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437317, "uuid": "f7b47515-bd3d-43fb-9d60-7bdb799ddc0d", "comment": "Malware payload (SnakeKeylogger)", "value": "3e7b8b3fcd3ab563a496fbd438dde4bfd324e4bc", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437317, "uuid": "0885574f-f7fe-445a-b453-8235b36b5800", "comment": "Malware payload (SnakeKeylogger)", "value": "ce886914b60767564c84834414f5720b377f68b80f2daccf0d471224b859d267ee19cfd771c68821e7b76e536ceecb87", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437317, "uuid": "f704e379-c9af-4da6-871b-36862e93dbd9", "value": "T1E97412A33554772FF91599FC14942115D5B0EC8FAE475C8223ABBD0EB038B8A5A0CB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437317, "uuid": "0fd48706-3b2d-4de2-ac36-9b49259eacfd", "value": "6144:DMqlW5matG73O/Rdtw2rYGQh3Qg5LLR+KE7Re00wfwx/fxuTtGrrg5gwkgth5am:wK+LGzO/pw2rYXigNLqKlxHg5gOam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437317, "uuid": "2e984b81-429e-4580-90ca-e3c56022a163", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437317, "uuid": "188205e2-4a46-401c-a4fa-814e3e93bc05", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437317, "uuid": "470622a7-2d57-4c5e-a265-07d25cd807e0", "value": "Order APO-074787648.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c20cc7b-2614-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633462969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462969, "uuid": "48a11098-1ddb-4dee-bf54-ab0b19ee7d10", "comment": "Malware payload", "value": "379838e742cfc29b58df5a63e68a1fef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462969, "uuid": "ffb32266-523b-4b75-a3df-fbff1386f52e", "comment": "Malware payload", "value": "2774da0c82b3700d74725edf23bef248083b6df616c7b494c05d4b5aec3ef2f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462969, "uuid": "704330da-7266-46a1-96f6-3f7c7b1aa3ea", "comment": "Malware payload", "value": "a5c1f5a313a378d81a90d8010102c393040923c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462969, "uuid": "c4a028f9-7630-4d74-a084-a6214170c087", "comment": "Malware payload", "value": "862478da1761b2c7951d0cef5a04eb971d064efd182f4fa7ce815781eb8dde95922d8c65e5ac9b0a417de82131e2d70a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462969, "uuid": "9852db97-bada-4e1a-ba4a-aace68b692d8", "value": "T111E5EF3FF61BF4A6EED7A939A09035143CA62D7B3C4C64683188A641D176EC07E47E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462969, "uuid": "b6beb990-2248-4820-80f1-5c0d5c0d9084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462969, "uuid": "68ed2f4b-3789-4942-8c73-9fd78696531c", "value": "49152:YJXZRkXRxWCBu72E76E5jXVL5w9lmVOALga7n0YA:KA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633462969, "uuid": "8db1c8fe-6cf3-4faa-9ba7-9e55850019df", "value": 3098416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633462969, "uuid": "42decb24-b837-47c9-9b6c-5f9aaba7c3cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462969, "uuid": "9f4ae66e-8ea9-40c5-8776-3b3906c75e80", "value": "379838e742cfc29b58df5a63e68a1fef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb1f58c-25f9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633451506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633451506, "uuid": "b25b3d2f-6380-45d1-8267-94507684c8e9", "comment": "Malware payload (RaccoonStealer)", "value": "340dcb4b84bdd26f4b10b876e066c541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633451506, "uuid": "7eb91d7b-db6e-417a-a29f-7b0f1c352f76", "comment": "Malware payload (RaccoonStealer)", "value": "27d384b972bb47b7501df14250cb7f5662867e1deb8ccdeab026873a33664e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633451506, "uuid": "6d9372c6-8c0e-403f-9ad4-8f62dfdbab77", "comment": "Malware payload (RaccoonStealer)", "value": "0f5406978774cb15dbcee1d2b741725e5dc00783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633451506, "uuid": "d33758a6-dd43-4841-9c1a-3d7bac138b9a", "comment": "Malware payload (RaccoonStealer)", "value": "0bc8bb58ec8a0cab76c719ed9b7f07b5643d80b11d6459b2b39011c12036d0e026ac3a5b2a5effa7e3d8ab80ddc33fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633451506, "uuid": "ef91029f-de62-4a6b-ac8d-561a20b8f537", "value": "T18EB4F11077F0C038F0BB26FA4575C3B9652E7D70AB2490CF62D16ADAAA386D49D30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633451506, "uuid": "bafad853-c9a4-43b2-b898-aa26aaad95a6", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633451506, "uuid": "7a32aa11-d20f-41c3-b636-84e23b771b98", "value": "12288:YfZr6+2OwjbmpavRiBXF41S2PTjSSq5N/:O6+0jYciZ4rP/jq55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633451506, "uuid": "56074210-d08f-47a1-8c37-8d324235c34d", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633451506, "uuid": "b79bb5d2-b42b-4187-90a0-05dd778aecd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633451506, "uuid": "e91239bd-461f-4347-83a6-8ac7ba12d006", "value": "340dcb4b84bdd26f4b10b876e066c541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cbda70-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633454422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454422, "uuid": "14e25c82-058e-4b58-b70a-07bc7b4c07a3", "comment": "Malware payload (AgentTesla)", "value": "c05a1e2f84a57bd5b5209e239faff516", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454422, "uuid": "04c0bed9-bb06-47ad-9593-14a8c116a721", "comment": "Malware payload (AgentTesla)", "value": "27e6ecff37e6b664635fb129bb540f27db1202b9dcfe6c0bc6767bf812385a1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454422, "uuid": "cba898de-6a48-4630-828b-3c1500f30aa5", "comment": "Malware payload (AgentTesla)", "value": "6638e5ae59edd751461d3464163a056fa8774c3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454422, "uuid": "623b2d0b-4f9c-44cd-9546-9572a2d2a761", "comment": "Malware payload (AgentTesla)", "value": "ce59f82c2c0eb0e1e4d39049dfc5909c1dd1c240612b7a4a5bfadc9d80a8974024961ac9e51ec01460f30182c71abcd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454422, "uuid": "ba3f8733-b547-4b51-be01-6771ee7a603f", "value": "T176A4BF502786DF16D5BE777880B1550093F2BB238F23D25E7DB580EC2D22BD09F2669A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454422, "uuid": "e688e1b0-5f02-4e45-9a55-7483a57f7e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454422, "uuid": "04ff952a-82b6-4ef9-8438-82c7adeb8337", "value": "12288:rnzopk/RH/k6EPYgqM5c7d3huMkHyhzMXD:rdJH/k6sYnuJtXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454422, "uuid": "086f5350-27cd-46ec-b713-bb7a08b42ddc", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454422, "uuid": "2d366c01-abd2-46a2-a74d-bb8e831e89a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454422, "uuid": "c9408d66-f5c2-4462-be5c-7207f3114768", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.7651.21421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded82f5-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633441981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441981, "uuid": "19173b98-8f4c-452e-9fd6-a2df9388a8c4", "comment": "Malware payload (AveMariaRAT)", "value": "bf7564bc839629652fe5afb347c6ad00", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441981, "uuid": "51ccc0bf-43b2-42b6-b497-025dadc58680", "comment": "Malware payload (AveMariaRAT)", "value": "283bccfdd8b56a554bab2ed08eddd1a8db68ecfb9fea6d9518dad9b650328c70", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441981, "uuid": "0119a34a-ad5e-460d-a9d7-1669d92d8e63", "comment": "Malware payload (AveMariaRAT)", "value": "13406a07579545e4e78fa558db097a3daadeb5cb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441981, "uuid": "4dd47e5a-94b9-48c1-99cb-4181da88e012", "comment": "Malware payload (AveMariaRAT)", "value": "658f0e361ae219e4cdf5cf746c983e14a137921670165a4914639a0b84e8842a60c72020fa669f4787cd76ddfbd12c62", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441981, "uuid": "998fd558-383b-471a-ad88-d91418e632ff", "value": "T139950A10B3A15124F9F767BA76B54694883E3C801F2DA2CF5A850ADAC62D2F47C347E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441981, "uuid": "842152f8-25ad-483b-9a83-05f2add29f7f", "value": "59db2621db4bfcbe475ffe9303a1d051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441981, "uuid": "ca5f240f-b8f3-41b8-b180-d976f505852b", "value": "12288:EGxLdGXOKiiEuuOa3A4nRPCWCimrlsQR4PD4pa7+oy1Z4e:9RGXgTRPCW5ElPC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441981, "uuid": "c6d1389a-5f4e-4cb2-b490-a21d3629bd5b", "value": 1948672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441981, "uuid": "3b4fa4fe-3754-49dc-a489-d29ce4834181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441981, "uuid": "2a98eadd-47ea-4f52-8fff-64b2e8ed081a", "value": "pre-shipment docs pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15ff5f5-25f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633450227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450227, "uuid": "136ff103-0106-4bc0-a8d4-1579bddfe723", "comment": "Malware payload (Quakbot)", "value": "ceef61fdebc46b6ced4f36b910f2f071", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450227, "uuid": "d8d07077-ca17-46ca-9173-7f0ebba229a2", "comment": "Malware payload (Quakbot)", "value": "286c02020c558b6790d19d456772d942968e94140fc905f62a746bda5719f9e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450227, "uuid": "2e8b13e8-da03-4605-9295-5ff6e0b12f36", "comment": "Malware payload (Quakbot)", "value": "16e85083a0a5a92b0b197921d15752aaa18bcaf2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450227, "uuid": "92e8445d-5440-466b-a499-047c454a0d09", "comment": "Malware payload (Quakbot)", "value": "4014df8f06a8393cb6e69d73132ee5b014c5b58e75b7e74c4ba684539fc83bee9b7959090ca7e32aba1a8a24228ef52f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450227, "uuid": "182a232a-97a2-4f93-be7d-1531ec21943c", "value": "T16FD3AD567797CA4BE54913398EE3879B3B72FC21DE72470332463B0E4E792A18C16A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450227, "uuid": "e206e2d0-1e1d-410d-9a86-f383e6a98fe9", "value": "3072:gk3hOdsylKlgxopeiBNhZFGzE+cL2kdAdc6YehWfGutUHKGDbpmsiiZu6NC06v6R:gk3hOdsylKlgxopeiBNhZF+E+W2kdAdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450227, "uuid": "3e0a987b-7c83-4c7a-8546-0de4d9de8e86", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450227, "uuid": "e030a639-f3b6-4863-99eb-0825ac4dda69", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450227, "uuid": "19734749-92dd-438b-85f3-3e0b062f7df1", "value": "Rebate-970927962-10052021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9de7d56-25a3-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633414566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414566, "uuid": "aebb00a7-68de-4997-bc50-e78ed3bec267", "comment": "Malware payload (Metamorfo)", "value": "5529c0a5e7e4fa342c6a5e9cda750b2e", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414566, "uuid": "1b7f2a91-4b97-405c-9413-86b8123a9afc", "comment": "Malware payload (Metamorfo)", "value": "28cee080a4e2204be415af61bb0a90f0e8f586ed06acb62cbe4a38fc4a997d22", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414566, "uuid": "1fc5d7cc-b8f8-444e-8a19-822c7483d568", "comment": "Malware payload (Metamorfo)", "value": "d965127a5033ada931784b7c9683c8d6f19514e1", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414566, "uuid": "eadcbc1c-d7be-4f51-affa-437ebde937f6", "comment": "Malware payload (Metamorfo)", "value": "fb92f93e6e1f472f23b1952bfe155bf6f0d3605469a030a0c92fda1aff5e09b57a08bf1370953d20682a9366ee8255f3", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414566, "uuid": "bbf80ecb-5dfa-41e9-ba34-439746cf3263", "value": "T19A31B1051ADA132AC3B3CE7A5077A2464A76FC51AE934F9E80C497DA2861054FC34E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414566, "uuid": "c95b09e0-5a8f-429b-a738-ec43734fb347", "value": "24:8+JUHRlVo5kcbA+PTSe+/P+POeh41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+rqce1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414566, "uuid": "d469cbc3-d3c5-4a0c-9d50-d36f839a1bd8", "value": 1564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414566, "uuid": "b84309a0-6186-4149-953a-c1fea97d1007", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414566, "uuid": "44d7d246-a4f5-480c-83ec-019e3081cdce", "value": "Curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86c0e28-259a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633410672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410672, "uuid": "272cb5a1-ac96-40a0-a0ae-17e4784b2dba", "comment": "Malware payload (RaccoonStealer)", "value": "5604e4dc70c604340d68222760eb6c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410672, "uuid": "cf97a133-c07a-4c89-a881-dab2994ae3f3", "comment": "Malware payload (RaccoonStealer)", "value": "29712959e15dd06735537ee66cdef63de2e25518e60308294c3cd5e227e14c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410672, "uuid": "03976e8f-049a-4da2-b67e-5c60b7b18df4", "comment": "Malware payload (RaccoonStealer)", "value": "a9120aaedc514f747c66fb0e02fa6f8b5d1f1e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410672, "uuid": "b2965fb6-4f2b-479f-bf4b-c8c7fc066a1e", "comment": "Malware payload (RaccoonStealer)", "value": "2eb259938d1f75399e31c2eb4ecdaefe7dc9e2e3c45d8468de64645fbc0929e23c5579a6f1b09870fdc54b6070d8cf27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410672, "uuid": "3140ece0-10ac-406c-a0d3-b110884e9efb", "value": "T194348D10A7E0C034F2B712BA49B593B9A53EBEB05B3491CB67D116EA46786F0DD30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410672, "uuid": "64e38c50-eee4-47c0-80bc-ef681c30e2bb", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410672, "uuid": "73a8256e-6578-464f-92c1-dc8741ec4aba", "value": "6144:ioj6bWHeStDd9TjB1INSGP5EuSwsbL3MAgc+:i6L+0Dd9oNSGP5kwsvsc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410672, "uuid": "d7cd92fb-c82c-4a1b-9071-cf3d99bdd3a9", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410672, "uuid": "0edcd04b-3339-4fd7-8d1a-d4d9f461454a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410672, "uuid": "f681f46e-1be3-47cb-a925-8d7d6fe6c6e6", "value": "5604e4dc70c604340d68222760eb6c7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f70846-2599-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633410263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410263, "uuid": "404a1632-ffde-43d8-adf6-433241fb2cc9", "comment": "Malware payload (Loki)", "value": "7fa461851c81f9cab695c435c4c27c73", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410263, "uuid": "004ab2ec-f53e-464b-bbb7-8464dffc52ea", "comment": "Malware payload (Loki)", "value": "29713690c478103f1e7586667bf49551045f74de94d934d4b420de24d634e74a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410263, "uuid": "8e5412c7-1b1f-434c-b36e-c303dccdbf35", "comment": "Malware payload (Loki)", "value": "1c1dcd734007c9e09111aa77e4dc1bc89eddd4bb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410263, "uuid": "22de4a89-bfd9-4615-a7f1-857e4fc34abf", "comment": "Malware payload (Loki)", "value": "46852c054de36ceafb59bea7388b69e35b5b328ee009310709dddd58300eb95b369cec4b2482b8148f12484422ca4adc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410263, "uuid": "1fab4aa0-9ddb-420c-82be-7318d3953dc2", "value": "T13B6423E2F768C323DEC3E1F49A64CD589995FC865A2234436C06FF6C48F9F09464998B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410263, "uuid": "1a7fda57-919b-4314-b112-5b87373ae72c", "value": "6144:76WpIfgO0+mYmJ/FiYpz3ub6mmu6eo4nGNSeiUO6bsGZ9FBhWGr2p2x:7ufs3/FXSH6eINSeipxGMp2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410263, "uuid": "78c248d0-441b-4aa7-b726-1dc205d637bb", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410263, "uuid": "22cc49fa-d68c-4204-bcf2-2ee4e20f73c4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410263, "uuid": "01e31780-cf07-486c-82fc-799a64d658dc", "value": "12005 RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd96835-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (Matiex)", "timestamp": 1633436964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436964, "uuid": "5c71a871-570f-4be6-99f6-91cdf906a45c", "comment": "Malware payload (Matiex)", "value": "2143f5e16ab1ccac518c5318607de780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436964, "uuid": "5570067f-6690-4a9f-849c-316bbdc14673", "comment": "Malware payload (Matiex)", "value": "2a110d7e364ad29a87c03c0418154c360c3be3f473fe0434656908d954e6bdd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436964, "uuid": "2c3fe422-b29b-46b7-b944-34a7bbb23d98", "comment": "Malware payload (Matiex)", "value": "ae2f3ef507ff24582316fbe556d84d28f0c00331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436964, "uuid": "c2bc7479-7366-4002-8a64-3f4ae634bdb5", "comment": "Malware payload (Matiex)", "value": "8ee55bd79111cc391e845f1fe9d353ec477a2f3d38094646121c0aadc03dcc537f0cca6d87a467ba5a16196c059f3507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436964, "uuid": "ca9b039a-6531-4734-ae78-86f39486d128", "value": "T1338423C50CF364EBC263AABA1CB7A335737B428D45255E0787C10B8B6E055AF910B7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436964, "uuid": "0d51634f-43ce-412a-a006-857d60bb7cde", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436964, "uuid": "57a7eeb0-0df7-474f-9478-7a00e344fbd0", "value": "12288:ys0Gz5X2/OfAXcsOf9phueoOEihwoxX8yV:P0m5XkcNlphudOEihwoxXNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436964, "uuid": "bc81b6c2-9362-48f8-acfc-84c72663ce28", "value": 399191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436964, "uuid": "97ec922d-7728-4325-bf9d-680e177f0524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436964, "uuid": "d0c54125-7a2a-4660-898c-cc59664f68c3", "value": "NN0900087890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935d675a-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633454445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454445, "uuid": "8ee24d0b-36bd-47f2-8a2a-0708a398cd22", "comment": "Malware payload (ArkeiStealer)", "value": "c322a6088c35747bf1682ba2c5a08d00", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454445, "uuid": "af604865-4ee8-49b4-a465-13143a849b32", "comment": "Malware payload (ArkeiStealer)", "value": "2a2875ac1142d27a036dcb875879d902c68097dfc3ba2d701be9df46b9015a3c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454445, "uuid": "48a61ba3-85b6-4f7c-a428-dc0f4636a9fe", "comment": "Malware payload (ArkeiStealer)", "value": "d66b314786c60a58e209c030cdca6829cf008f69", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454445, "uuid": "8f82956a-d27b-4fcb-9a24-986e663172c3", "comment": "Malware payload (ArkeiStealer)", "value": "40f7aadea75ec9878964be2ab1db2dc9b5ab16010eedd2b983f3aa6bc678ff882c2062a8923f95ce519bf748fc8d8502", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454445, "uuid": "8dddedcd-63f9-40c9-b04c-c9de36a9195b", "value": "T14EE4011077E0C038F5B312B589B893B4A52DBEB09738D9CFA6E55BEA56785E09C30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454445, "uuid": "02d0772d-89d6-4f55-8e35-ced97b4b7100", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454445, "uuid": "0ddcae83-4571-4abe-b791-b005ac62f595", "value": "12288:JawAsS3wOdz/EGxvZc0ptE26Cc2C++y77Ix9cuJgeSzFz:R0Hzlxm0pXS+F7769pgey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454445, "uuid": "47288e50-d991-4504-b443-ef875efd211b", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454445, "uuid": "e1283e92-a809-4f1b-9097-57a4e42a2477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454445, "uuid": "1c3d1538-c7c3-40be-9dc2-841c4af449fe", "value": "c322a6088c35747bf1682ba2c5a08d00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce83956e-25bc-11ec-843c-42010a9c0014", "comment": "Malware payload (ZLoader)", "timestamp": 1633425339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425339, "uuid": "fd708869-dc84-493f-b77f-f69971a1e7b7", "comment": "Malware payload (ZLoader)", "value": "5376112bebb371cdbe6b2a996fb6dae6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425339, "uuid": "fd296b68-022e-4036-9f54-5a40ca31f06d", "comment": "Malware payload (ZLoader)", "value": "2c0d8fc0740598fa97c5d1b21edb011c8026740b77029d29c20f3275438ebfbd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425339, "uuid": "9dd7b1c9-9249-4693-be8b-a4327e07eaa6", "comment": "Malware payload (ZLoader)", "value": "a0c97cd4608d62e2124087ecd668c73ec3136c91", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425339, "uuid": "f370a149-629b-4a62-bdb7-b1ca786d240d", "comment": "Malware payload (ZLoader)", "value": "e09c4a8a388a24092c2178ee7d62c6fe3ab97142d5918b5b278562d4a550785aeb8a574e89133bde0c51680a2d7ea3bd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425339, "uuid": "b2b88d04-d2ea-41c2-be4a-bde82566c166", "value": "T1ACE401217590883ED7FA0931A97EE231AE7CFD181760C51E8384B80E5DB85E127B7B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425339, "uuid": "3759e11f-8c44-445c-905c-77f0dd1b1752", "value": "12288:pt3jOZy2KsGU6a4Ks9KqnFhcsHTCFsRsXP3/9sXBwUJ0I3Bj:HzOE2Z34KjqnFWcT5Rc/9sXBDn3Bj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425339, "uuid": "1cb51c7e-8a20-4889-9e50-6d763b45bdb7", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425339, "uuid": "902a4b8e-721a-49ee-9112-e26e74c504d2", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425339, "uuid": "c822069c-fd5f-4621-8256-c5a2fe8281fc", "value": "34d026.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f391f4-25f7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633450376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450376, "uuid": "011e1fda-2e12-4bb5-b270-a04e1cfb794c", "comment": "Malware payload", "value": "2a010bb9775bc739ced3d34f4c0e6175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450376, "uuid": "5f91dff7-cce6-4c87-afc1-708e9769db98", "comment": "Malware payload", "value": "2cfa6e09ec6ebc184774238d6a497df43c5eed8c2c03e86e830400c8b7fc4ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450376, "uuid": "f6ed8579-2c2b-4433-95a0-ce22118ddbb9", "comment": "Malware payload", "value": "f73d6360fca7ca9cf85b56e2419733e42796c8ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450376, "uuid": "15298fcb-f438-4cf0-a014-6f66640fb3a5", "comment": "Malware payload", "value": "5827718229f803903d19f4ded257b06d9a11c7f336849ce2a1fb27bd2b6c7020d8e702fb98fc2531bc7e1f5ab3aa7edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450376, "uuid": "265d4051-2342-480d-847a-0e7c348276a3", "value": "T1FB35022A7657860ED063E73EDD63EB4017A19FA95CE2870EAAC531FD413A7263C50F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450376, "uuid": "c57f1afa-036c-42db-b7c2-a3ea3f59467d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450376, "uuid": "aa31dd10-2b8f-4ec5-b846-ff85d078a7ae", "value": "24576:o4k9s1CbULw6fLOQ/TewNBm93HMVprs/lppB:o4k9s1CG//TLNWHEprEpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450376, "uuid": "888d1913-0988-43b6-b753-c79548d4089c", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450376, "uuid": "6f598eac-58bd-490a-b442-45cd8302ee9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450376, "uuid": "af05ab08-002a-43e2-9125-75036b1f4e23", "value": "9876543456789876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26ea091-25c2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633427842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427842, "uuid": "800b0380-4943-4567-bb83-cdbb84eca9a2", "comment": "Malware payload (RedLineStealer)", "value": "d46b9640171929979ce9e6b061fecfef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427842, "uuid": "e31c48ea-3eec-4fa6-ac0b-27bbffdfbb60", "comment": "Malware payload (RedLineStealer)", "value": "2d100cc76f229ac10a7589e1aea0bfb47b5692840d8f2b7a1ea56df0f312d1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427842, "uuid": "d1acb64d-debc-4746-9398-9da53479be61", "comment": "Malware payload (RedLineStealer)", "value": "4c61c840ff3baaea3625cc65710351fb0528b7af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427842, "uuid": "b327ca18-a3e3-4c9c-967d-0d8de8da448c", "comment": "Malware payload (RedLineStealer)", "value": "7156f13672ab4c5ead4eb7642041e6ea6bc75f99a791ec5519c756d4405e11045fe97f3b09c2f4a381d955fe4b619c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427842, "uuid": "d44b2cdf-596c-415f-a4a6-60899579ca6d", "value": "T16126330C37C6C0F1E9DB81B120DA87E4B4D25D9DDAF418DFA2B666CC7E23424BA05676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427842, "uuid": "363ab1fa-912b-44eb-8733-d6d6b820eac2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427842, "uuid": "8352c27c-684c-4acb-bf4b-9ce80bed0698", "value": "98304:JlpROMtlsnguKxZVq2px191DiS7hig3OWUHawULEVjXKO6z92tsnR:JNOMtlGMN19liS7/OWUHaIjJvtsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633427842, "uuid": "fa9d80b3-98fe-4dca-8478-1997ec6bf1f5", "value": 4815426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633427842, "uuid": "e8a47ab3-5b57-44c1-8941-f05830201397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427842, "uuid": "7a39a628-0bac-4dc8-bbb5-5d698bc96122", "value": "2D100CC76F229AC10A7589E1AEA0BFB47B5692840D8F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac59f7c-25fc-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633452901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452901, "uuid": "c09e03c4-f69e-4ed8-97d9-02cf6b8fa589", "comment": "Malware payload (TrickBot)", "value": "45bd1517b770fb31e70eb9d1b415dfef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452901, "uuid": "934f5b1a-f15e-41e9-a132-a20f4c9a9cb0", "comment": "Malware payload (TrickBot)", "value": "2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452901, "uuid": "e48ef3c1-db84-48d5-ac10-d125a6f88cdb", "comment": "Malware payload (TrickBot)", "value": "cf770ccabffb62bcde88e41c50aa50896d856703", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452901, "uuid": "28896866-49e8-433a-9200-cdb8dd53ec40", "comment": "Malware payload (TrickBot)", "value": "c1ab9ad2a21c95b751eb261ceedd1689eae1474fa5d4c247429b2e6ce5e44d9ac39e74c9e997f9e61aa0da02aa6c79e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452901, "uuid": "80f58270-5e37-45c8-a8a0-5e8c5334c7b4", "value": "T164A4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452901, "uuid": "28a211eb-e51f-41f4-9a69-cad42fd6fc20", "value": "f34a0f23e05f2c2a829565c932b87430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452901, "uuid": "df4e7362-1793-41d6-ac48-f428de2cf82b", "value": "12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9KllE:bEKNb/aZl6KdSrs+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452901, "uuid": "3d0cbb87-c30e-492a-b4a9-3e5b166ccc72", "value": 487551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452901, "uuid": "19c145af-e3ea-4278-85ee-df92049eda71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452901, "uuid": "121297a0-1abc-4e35-b0bf-d725957802b0", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8359473d-25c4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633428648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428648, "uuid": "ada2ee2d-98bc-4c54-a210-2f9b495a1cb5", "comment": "Malware payload (RedLineStealer)", "value": "66cf057af6a7014d593b3afc35ea9a6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428648, "uuid": "fa510cf0-2f1f-414f-93e5-af8d3dfb311d", "comment": "Malware payload (RedLineStealer)", "value": "2dd987d10f7a7dd97f22eec0a845b5ff10436e622606034468ad5c5e76f89381", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428648, "uuid": "ac7dbc76-f3ae-4fc7-8626-7fdf28429fc7", "comment": "Malware payload (RedLineStealer)", "value": "a92f480476758b1633355e10e6b9b4251a3b8681", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428648, "uuid": "8bd26011-e462-409c-bb14-e2397d3844fe", "comment": "Malware payload (RedLineStealer)", "value": "82fb4b374f65465a7e05524dd9bd340b14df5e3d57cf032cfae6d3331ee886b91a1c363da27a23408eb23aac05557b8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428648, "uuid": "b7a23bc0-09d9-40a8-ad40-3fb8ee218a99", "value": "T18E64B585E68856A4ED6D9B70A532CD314273BDEEA834A61D28CE3D773FFB7835011092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428648, "uuid": "f4014caf-8a95-4d30-9cdb-9c12422381c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428648, "uuid": "efe0edad-3bf9-4d25-9910-1f961451ab6c", "value": "6144:TkZWy+CjAkzL7r9r/EDppppppppppppppppppppppppppppp0G:5QP7r9r/+ppppppppppppppppppppppJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633428648, "uuid": "c6fb259e-3dbb-4c28-b187-1fcda4fa3458", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633428648, "uuid": "705c514c-276b-4892-a00c-35119cfcc317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428648, "uuid": "1b7b318f-083f-4b67-bc9c-28c4d8865ceb", "value": "66cf057af6a7014d593b3afc35ea9a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08728fc2-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412121, "uuid": "12d6abe1-e70b-412f-a127-7fb3eeb70644", "comment": "Malware payload (Gafgyt)", "value": "8dac9b5cf361b999af1979eb1c95a621", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412121, "uuid": "931e91f9-e713-4c48-b098-f02c8040f633", "comment": "Malware payload (Gafgyt)", "value": "2e8aba9eb57a9b703b2ab063a469113077d704303fe5623b88a247f02f4edd39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412121, "uuid": "4bd9f01b-a42b-4654-827c-4dba1ff73f29", "comment": "Malware payload (Gafgyt)", "value": "97795391a8b631f9b506d1fe2e5ef2479135bed5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412121, "uuid": "909f1241-af0f-4872-874d-f748aa86d076", "comment": "Malware payload (Gafgyt)", "value": "0756a641177b60b8bfcb299acc1b36332b3339171f37e3e63748f6c3c8b6c88bf350aa095eb39292b26779ee20a098b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412121, "uuid": "7c57f7ca-f930-4209-b7b7-7bd63db3475d", "value": "T132E34B05E6408B57C1E2277AF7DB424933239B64A7EB33059938ABF43FC27995E32506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412121, "uuid": "757aaf7a-513d-4885-8ee7-069fb2f33886", "value": "3072:JqnZaeOSke4dYdB00K5rLnyJoM/93ZmMwfvRQlTN:JWZaeOSkbdr0K5LnymM/93ZmMwfvalTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412121, "uuid": "58328dd8-4b5c-48f2-a7a0-18016d44138b", "value": 153483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412121, "uuid": "d673ecbd-0051-4dd4-b4b9-0deb180388b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412121, "uuid": "5798b6c3-888a-4487-b4a8-0e05fdc3c5d8", "value": "8dac9b5cf361b999af1979eb1c95a621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b696d32b-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437324, "uuid": "90ef26b6-fda3-41fa-a51b-f356e1720d97", "comment": "Malware payload (AgentTesla)", "value": "8786e43a9b5b63c5d74d07db221eaff0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437324, "uuid": "3e2631f9-f32a-4c32-9186-bda4f1b8f6ec", "comment": "Malware payload (AgentTesla)", "value": "2edb6be36d8cce7fd06e3589dba3a6bc4f62541141619e2ef70d1b5ea297198c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437324, "uuid": "26a8fd70-55eb-409e-8702-1c09c0245202", "comment": "Malware payload (AgentTesla)", "value": "c6c2a8ea1c59e39d13bdee4adefd123b0fb128ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437324, "uuid": "d41cc81a-e02f-47a5-b966-1be97905139d", "comment": "Malware payload (AgentTesla)", "value": "caf804ecf6fbd2b54538722eb018088b1eb697a71f2e20beb71e59a6685d352db7f5d9fa07aa1340191dbf473ad2083c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437324, "uuid": "23bb00a1-763c-4faa-bb65-480710c3ea6a", "value": "T12A64128473884B6FD11717312F1FE951E8A6CD96BBB0C00DBEA0FD4D3336980969B996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437324, "uuid": "b445cdea-9f3f-4393-a85b-15b5603bba9b", "value": "6144:wZ4+IxO1yPu/k4MmuCGlGsBzaBIeHkLSoQB20/xt1AGc7SkQOhmH:e7IUoWk+Gl5aBIeVoQB2KtqSIhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437324, "uuid": "395a6a50-19d8-44cc-b627-d8367c2c2a9d", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437324, "uuid": "08bfeedf-f637-490c-92be-cb86268fdb6c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437324, "uuid": "c3f6a946-7316-4290-b022-77ce5fa8f264", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7091042-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633413300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413300, "uuid": "aea6308b-bd53-442b-8bde-2a606694a54c", "comment": "Malware payload (AgentTesla)", "value": "3c60e424fdbf206b064256ce4b202f94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413300, "uuid": "547bbd7f-6850-4da7-885f-1dc3b79b4bec", "comment": "Malware payload (AgentTesla)", "value": "2ef2cf49d9a97a14387c82a44bdf3ebb94c623649e404563f0bfd75dbfaced9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413300, "uuid": "1292c7b7-fdde-4b56-92eb-eab36b2d81a7", "comment": "Malware payload (AgentTesla)", "value": "9b9f437f25c9d507f1d941f7b992c38bf03de3df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413300, "uuid": "6af2165a-90ba-4e07-aef8-bb65b4127b00", "comment": "Malware payload (AgentTesla)", "value": "ddbf7644c4684a3ed5455f4d270ab01e91995c73bc5aa41135c89d10a7ce58c7ccb68491b8bf69a7091c0f0ca06f4aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413300, "uuid": "82d4cc19-2b13-4016-8b9e-b564a46c91c3", "value": "T1DAA4AE243DFA5129F1B3AFB95EE475869A6FF6733A13E41D104103860B23E81DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413300, "uuid": "cf9afb49-eb02-4b1a-b7c7-ae2f5573aaaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413300, "uuid": "17c919d6-5ad4-476d-8eba-2cdb9004916e", "value": "12288:gBk4DbF53e0IUFLxEI9SE/K9fPSocfApXRp7L:+FE+F/EJ0ApXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413300, "uuid": "feeb7492-d37b-49b9-8ff4-95e85e6b4d13", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413300, "uuid": "185efd0d-a94b-4ba0-8b8e-2683a4dd2436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413300, "uuid": "9423d375-9130-4ba6-90a1-a5f42b8f2b4f", "value": "RFQ#00521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157c387a-25b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1633423310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633423310, "uuid": "f8ec9584-ea22-4360-a5e2-b831b5af976c", "comment": "Malware payload (Pony)", "value": "d2e89f93c624fcf5ff67ff2d9e96ec21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633423310, "uuid": "15df43be-32af-44a6-872a-c8bbea0d5aae", "comment": "Malware payload (Pony)", "value": "2f156f7150ef3b1c8d0ebe2427e20452bad0e3ab31c30e17e200308cf0efa78c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633423310, "uuid": "26156d65-115d-4e5c-981d-a3b4056769ab", "comment": "Malware payload (Pony)", "value": "cbb7ed3b4a468a6193a930ae6e8a5b833372d66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633423310, "uuid": "666591b0-984d-47b4-8bf7-a04321dc95a6", "comment": "Malware payload (Pony)", "value": "eebe3677144d011de2272810d6df9d1e1b17ab65eb5f919c115184e29dc83d890ed23054448390d4b98af33b04d274a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633423310, "uuid": "d677c180-2e73-417e-aea7-29e1d91256e6", "value": "T11CA4F61B54E27EF6EA04D3F06418E52B8B9B006D3BA63356BE1E89476C3FCD58973904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633423310, "uuid": "e861c95c-e827-47af-9ca1-417cf110e229", "value": "12febd1700af549791b870126c3e68a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633423310, "uuid": "c122bf1f-ac98-418d-a5ee-7848c2d160ec", "value": "6144:lwq/ZxYoX6qUtFlSH8B1ZZUpm+EPT7SvxWwNgsorulG5VZB/o1yJcal+kU7oMUbK:bxSqKSHiyEP3jrx/uboVoZxRye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633423310, "uuid": "98fc2d65-efe2-402b-8907-4b1ac6570f10", "value": 488352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633423310, "uuid": "587ccca4-9159-47b6-8f19-d8a2ceddd0bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633423310, "uuid": "0e1dde09-df9a-4c1f-ac24-e474fd14deb2", "value": "2F156F7150EF3B1C8D0EBE2427E20452BAD0E3AB31C30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0190e701-25c1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633427142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427142, "uuid": "c43ecd49-9107-4e9a-90c4-2e571b7d82c7", "comment": "Malware payload (Gozi)", "value": "fe127f07c086ee240c4699ae97b23672", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427142, "uuid": "789bef6a-dd8d-4ce8-b382-40e4815d89e8", "comment": "Malware payload (Gozi)", "value": "2f4d76314a00fb7a8047fcdd3ee26c39d2a550cde356d35ae517631392a66e8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427142, "uuid": "10193ce7-e71f-442a-a9c4-fc6d346d4960", "comment": "Malware payload (Gozi)", "value": "980b76c3bb9f12c2033897c9e432c3f0f4d3db31", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427142, "uuid": "528c19af-61f7-43c5-8343-c2bc6d668314", "comment": "Malware payload (Gozi)", "value": "82b4da04e6e85726da6ac17aa87242cc9abf32d47e68fc9fe7366bbe22cf0fbd3915bde942c8dcd37d186ac892742739", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427142, "uuid": "8909b34a-75a7-44f3-b4ac-ba8b3941d01b", "value": "T1C145DD543A54F510EBA96972CF6AC5F907057D09EFF1B49B78E03E0F2AAE8A3D512301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427142, "uuid": "07667050-611a-4de8-918e-9acf7fbab1b0", "value": "3914a19d88280b08f06c9e1ef6320e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427142, "uuid": "6788ce3f-438f-4d44-b5f9-aa6e28632a99", "value": "24576:EQWt7MQhrgc/IQA3DEEf3cFDZYbZy8zl2ws5KHGv/ChfHOtpfdwuPiHT8XYAT/af:xuHrgc/IQA3oEvcFtYbZy8zl2wLHGv/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633427142, "uuid": "c5373155-2ec3-48e9-bff5-4703d0ac2044", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633427142, "uuid": "62f41a84-2af8-4803-a037-74eab8e3e5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427142, "uuid": "81959a2d-761b-47ef-b9ee-c61bc27f2e69", "value": "#Gozi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1888d08c-25de-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633439636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439636, "uuid": "7106a9d1-c37f-4f40-a79c-6ee3800c6878", "comment": "Malware payload (RedLineStealer)", "value": "2980825da7488d32a109913e2f2ec26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439636, "uuid": "2fc0686d-f4f5-4923-8f5a-a1f6e7b4b851", "comment": "Malware payload (RedLineStealer)", "value": "30e473eded24bbe01ab4c65608793d380d5daa0a1cb3dfc9af5033ffee43c989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439636, "uuid": "6e8d4a16-5c60-44af-b840-b6b0e7369673", "comment": "Malware payload (RedLineStealer)", "value": "0e770f4857cc1c6e40960bf70231bc0d8be1ef18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439636, "uuid": "464f4e71-3efe-46e0-8452-283bc6cfa80f", "comment": "Malware payload (RedLineStealer)", "value": "de888aef618de51857d967ed68eab8f4ee98d4e8882b354353c7e6a92ee501d5fa25905254dded5238f50ebdf74110cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439636, "uuid": "33ab5dfa-b213-45d3-9c5e-1afc5e028619", "value": "T1C2D47C64E22FE76AFD1923F0213CFCD415F82A69147CFA27BDA651E27489E3051B0693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439636, "uuid": "8a25be4a-9610-4f98-8c7a-f85350135b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439636, "uuid": "0f18dd66-5203-45a8-8cd7-2afb780be552", "value": "12288:/qIbQ+X8+UiDLbRHahO9/mGng/WVTcKldNh0v3PZSC5VjymT:5bQ+X8+UiDLbRHahOt9xcm90v3hSC5Vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439636, "uuid": "60b7b36c-20c8-4fe3-bc75-ea3fea5d8467", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439636, "uuid": "fc6c7a04-de0b-42f6-ac1f-cfda236b4e0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439636, "uuid": "7f8f2550-a232-4e51-bfe4-c9ca91f0e4eb", "value": "harshmanzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d579fb6-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1633440986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440986, "uuid": "cc3d8562-7c2f-4093-9bc7-c8bd4280cd19", "comment": "Malware payload (Tofsee)", "value": "4854a42e3f0e398b5555a9e1af39aefd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440986, "uuid": "ea382174-c96d-49d3-81a0-d345ab345a94", "comment": "Malware payload (Tofsee)", "value": "311124b440db71628576eb0498a7f3b0ae5f185ff3ad358dfca44949dd868b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440986, "uuid": "380b8108-c05e-49f1-8201-caf787fdbf41", "comment": "Malware payload (Tofsee)", "value": "dd16fed472439aa7e80a040b8835238a1e7ea4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440986, "uuid": "ec9f98fd-953b-4601-a89d-13f504e0bd02", "comment": "Malware payload (Tofsee)", "value": "feb96af807c40c335d6708daeea361dae460dca970dfffa36f5033d828c79b36698847b57165e1f8a04b385b3c1a319b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440986, "uuid": "68f68ddb-35fb-41de-aabd-00e84dd6463f", "value": "T1EB347C1067E0C034F5B712FA49BA93B9E92DBDB06B3495CF62D12AEA56746E0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440986, "uuid": "85e81d37-6298-446b-9fb6-5bdbb17cf1e1", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440986, "uuid": "42495071-a0db-43bb-b118-e4a2dd6c2c63", "value": "6144:j418XPQp1Gx5SOnKDA7MyPINxT+YeJkCmyNY:jc4A1GxQOnP7MyQf+9HmyNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440986, "uuid": "ec5fabcb-adba-40a6-9818-efda36fc07be", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440986, "uuid": "1b8041fc-762d-402a-85eb-52e6e0cfb79f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440986, "uuid": "ef7b1696-86e1-4988-8980-6b188e8f340b", "value": "4854a42e3f0e398b5555a9e1af39aefd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bde64b-25cf-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633433462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433462, "uuid": "4c4617d1-99f7-48f8-b168-a355f62417ef", "comment": "Malware payload (AgentTesla)", "value": "81130e405dbaf6c793dde24ffef31cd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433462, "uuid": "0f053e9c-66cd-4ba3-971c-6e82de9b2875", "comment": "Malware payload (AgentTesla)", "value": "3146451b8705dcf7a850cea01e3e68513448d9f92212129162e8c5d80ff1020e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433462, "uuid": "52ba2f95-ac55-499f-8292-6473157a639a", "comment": "Malware payload (AgentTesla)", "value": "0d60d8668c619d621f192e3b509af944e86b1528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433462, "uuid": "f6f3bcf0-3194-4566-b948-bbe363722137", "comment": "Malware payload (AgentTesla)", "value": "5f4f18d5ce81b970a20f8a6d741f99f8eeac63932ebba6bedcd44eda925330dc8266954c73d81c559b9ee912e0b29a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433462, "uuid": "7f09a3e4-7def-4fce-8dfe-e2426ec20b02", "value": "T18DD4DF2886234752CCE4FAF2AD38D7504FB67F94C199DEAF3A94B0E92DE37676050406", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433462, "uuid": "96ef80fd-19de-4844-b57a-0c1d7776fcad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433462, "uuid": "df8f2225-6258-4427-bfef-e476df14d341", "value": "12288:dzIoiXcyFC7AL+s2gvuWJ8O6zViZAy9NDN8w:lI5XciaAL+sh81zoZAip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633433462, "uuid": "250eabfb-4b55-42ff-a981-0427e788d49f", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633433462, "uuid": "24b834c6-7be1-4c3a-8c3b-520500e65cc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433462, "uuid": "c6295860-cee4-4ec4-8813-14d405461bec", "value": "VmvadDHPESlhU8X.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d2609a-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633416657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416657, "uuid": "49d59c83-2dce-4ab2-a333-9f0dc07aa212", "comment": "Malware payload", "value": "760e4ba069af50a1e0e4588569a8e7f9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416657, "uuid": "767b5c91-a5ef-45d9-bbdb-70b450bdfb40", "comment": "Malware payload", "value": "317ec45df7cbc847af0c119eeddd13a0c68cc78bf14e5122b4adf1d61580de7b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416657, "uuid": "736728a9-02b7-4b24-a284-5abd58d40cb4", "comment": "Malware payload", "value": "6e93987bfb7ce8655e45ddc438f261a5c7982261", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416657, "uuid": "5cb35627-8c62-4275-ad25-9de5b46324ea", "comment": "Malware payload", "value": "79c9bd64edc1799b82f41c926bc029b9807a75abf23493a7a0ef05077f57c22cb266c765dfc08a0f21dd61bd5753bffc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416657, "uuid": "8ea7b7c0-9499-484e-9a10-07be3d1b374f", "value": "T1CAC57D22F2D18837D0772E38DD6B6359A52A7E601E38584F7BE41D4C5F397803A292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416657, "uuid": "2a00ce5d-2184-452b-8fb2-bce702f18692", "value": "49152:QhfI4zTZ7aFO7ZSBCd67ITPOO5vOYLSA:gI43ZYOXjJ5vOYmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416657, "uuid": "15f7f704-4c3a-4757-bcf9-4f4b18822d5c", "value": 2614784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416657, "uuid": "dc850304-073f-46e1-9289-a7bc787382a0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416657, "uuid": "5e73de48-1351-45cf-9029-bc810652897a", "value": "ab fgqobbgxbkbdzynwltjhlzvkfsifwhgknxsaqcxnxhnopniwelyugml.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a95279-25ad-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633418552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418552, "uuid": "d038d9d1-2a6e-4567-bbfc-086221e1789a", "comment": "Malware payload (TrickBot)", "value": "e22a7e2050265f88b69b67364c237e7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418552, "uuid": "e3576c19-2ca3-4e1d-b408-d6a55e19b5f5", "comment": "Malware payload (TrickBot)", "value": "3222c4bd58311ea4b19245c446cf2088c12824b73d643b3a12b153bc3d818e35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418552, "uuid": "5e69111a-715f-4a61-b67f-bf7ea6dfc6a4", "comment": "Malware payload (TrickBot)", "value": "166ae7e6c06fcad7e6b466f72cff9a2011b77f92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418552, "uuid": "e45b660f-acb4-4e90-a06b-dc2c16f9b07f", "comment": "Malware payload (TrickBot)", "value": "da67a5bbbc70843798a5cea669b8ee57b0602346ccbd84e23a76a56753ce16378b119ba6ac84e2eda3ddde3696a36321", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418552, "uuid": "5277751d-e415-44c8-b28e-d9e193cae228", "value": "T1DFB4F1023AD584B2D962253209EAA73FB7B5FD458A32CF47A354FF1DDC30141A92B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418552, "uuid": "4510d6f4-bc35-4150-9890-25948461551b", "value": "e38afb91bac491f7825e4d9386ac015b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418552, "uuid": "f9d57ccf-1bf1-4b1a-ac24-d4c520f73233", "value": "12288:S1RdEJFGqNkbHfwwK7pzoutmIp57vDGr:S1RdEJFGqabHINi8F5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418552, "uuid": "5596abbc-f48f-4555-9c29-94eb585f4d6d", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418552, "uuid": "bfd726f1-8db7-4b48-99bc-96159a44b6c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418552, "uuid": "980ca810-e4af-456a-83ba-d3eeb967f06a", "value": "e22a7e2050265f88b69b67364c237e7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45fa138-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633441186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441186, "uuid": "b7408f99-7a80-4d99-8842-7f5077757d9a", "comment": "Malware payload (AgentTesla)", "value": "6e7464c9c833feff12027b0ca54f63e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441186, "uuid": "ebef58fa-b7e2-462a-8697-711a9dcaa464", "comment": "Malware payload (AgentTesla)", "value": "33ca31452fa88581eb327146aed3c6c18fff650c575b2e2d29024f3b04eb4a80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441186, "uuid": "74a1da9e-105c-4665-af63-63f3a9cd98b0", "comment": "Malware payload (AgentTesla)", "value": "08104d98dcbd383830a1f8144687e7eceb4ab3ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441186, "uuid": "803b6e97-96fe-480f-91bf-0b98a65162e1", "comment": "Malware payload (AgentTesla)", "value": "5745fb319d13143a0e137e0d0b71c70e9047befa9c2dfbc9f3ed379118f36538ceeee410abe45aa63dd41556e24f2535", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441186, "uuid": "ea043705-acb1-4b1d-b062-1613ddf67ebc", "value": "T1E0B4CFA8335FAF06DD389FF4152CA19157F6AC371579D3690ED1B0EE2922BB00A60B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441186, "uuid": "93f2d85c-87c0-400b-b889-9d777a373dea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441186, "uuid": "a5100da1-19e1-46a8-97c1-7cd883645a0f", "value": "12288:992j5occ0WI27Ji+3hE9g+gtts/36QPbQLi:85rc0WIiJr6LDKQTMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441186, "uuid": "ec63a72c-b8f6-4f4e-b702-d05c4f989a73", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441186, "uuid": "4790cb8a-4c87-40ce-a151-22d9b1bee0be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441186, "uuid": "cb589d86-ebac-4835-a187-7d99151a8b38", "value": "CY2075400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae65f9d9-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437740, "uuid": "08382acb-3d70-45b1-b5da-1da7ceaccb6f", "comment": "Malware payload (AgentTesla)", "value": "20cbd3338099924a4a04b764c435b810", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437740, "uuid": "a382eb97-d13e-45d2-ab02-fee0e1e3f8cc", "comment": "Malware payload (AgentTesla)", "value": "34eea6efe1c6bf1b1d7d6c92c4c5897564975e63dda3454a68ac4e19f44b976a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437740, "uuid": "f39cfa1d-c42a-4164-aa03-ec8c27f2015d", "comment": "Malware payload (AgentTesla)", "value": "0edcb1b88daa55c39b232bbcfa53379060787d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437740, "uuid": "31b7d368-b663-462c-81ff-fe7ad42acbbc", "comment": "Malware payload (AgentTesla)", "value": "1e05a4d95ef5998565e20877ad780707db92a2fb0edf1afec9a69a17e20916cc96195e5e76c9a30f380aeb0d86ac956b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437740, "uuid": "63ea35c1-dfeb-442c-93a3-88ee1af84c33", "value": "T1CDC4DF9423AF6F85DD345FF4182C919143B67C3724B9C7690ED6B1EE2A32BB10A90B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437740, "uuid": "7733840f-1590-4656-8e5f-442ed4669f86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437740, "uuid": "bdf3ef7f-ec0d-443a-ab37-9ef20d1782f2", "value": "12288:3++tocc0WlVzTodbDhwCBNntu8DmbeOAItAu90/R:ptrc0Wvz0r9Nn4AmbeOAG0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437740, "uuid": "f29c3663-8219-4114-9788-e85e37fc7402", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437740, "uuid": "d3824aaf-4a76-46fa-961a-9bb55e4b384c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437740, "uuid": "570e0ee2-616f-458a-af82-dc02f894cc90", "value": "Bukti-Transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e107f3-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633437320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437320, "uuid": "c329f0f8-4660-41c4-8f3c-c1123ba4566b", "comment": "Malware payload", "value": "6df0b9a1a863cb5bcb19061a4309bcdf", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437320, "uuid": "646dd4f7-1b4f-4f40-bc87-f1f2e0b491a1", "comment": "Malware payload", "value": "34fc934b8ca45ebd4a509ae158ca562bad3c9018d4b0b35606603048d60f6969", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437320, "uuid": "4a23a383-c335-4144-ba62-828b243d9195", "comment": "Malware payload", "value": "22723740ba35c27171f26c1c1d44ce2a60f91262", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437320, "uuid": "e68a6fd4-5ea7-46ca-b27d-f5ed5a58d393", "comment": "Malware payload", "value": "d965e1a8385e0397e981c766f937e8c36362b3743df9f8cf25b9d3473cfa103466cc68bacaaf96c9a5d1291d60cec76a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437320, "uuid": "117bba69-e808-4740-9333-d0a2d22484b6", "value": "T14564228236B3C317ED964839E421C954F633FE62FF7E41A0948FBA5918B8B92F031615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437320, "uuid": "643c9435-815b-4477-a35b-d1764b6c4bf8", "value": "6144:2AQmZYQCQlMxPtZCMYPVimbKO3CdjjLDgrPtxZdjTRCzdfsPJ4ArT:2dvQCQ4PtZOPViWy1DgrPX8zEGAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437320, "uuid": "d6aa1180-1590-4f10-bbb1-f0fc9ca2a5be", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437320, "uuid": "7b989ab5-af09-46cf-9d66-33ba9336cd55", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437320, "uuid": "d1862ad6-a29a-4b8c-8c64-0e211a0c7ba2", "value": "SLI - 32118360 - MINDA INDUSTRIES.XLS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b019d3-259f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412835, "uuid": "f43b5dc7-9d76-42ad-9b71-b890f0a1c332", "comment": "Malware payload (Gafgyt)", "value": "0e2a4af8d35ddc10e344d662a52ad6ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412835, "uuid": "37c958b0-992d-4502-b381-e99405b7ab1b", "comment": "Malware payload (Gafgyt)", "value": "35fcc1e42d7145dd92f0a1e94a394b1d6ab940ac99ee32b0d7e4aa0ac5af6f69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412835, "uuid": "199c9ab0-3c20-4b60-8a3c-430bb039e9b1", "comment": "Malware payload (Gafgyt)", "value": "6c148e0ded088a994af8dd528041ec841a71aac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412835, "uuid": "3d9e48b7-db1a-45c0-9aef-d4d15f0be55a", "comment": "Malware payload (Gafgyt)", "value": "953422a75e2345089fc7c883a6fbe4fe00d6b4a3c26e6ea42569127425d0ee23548ee5011f70fdcbff0e045613f3baf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412835, "uuid": "c95aef3d-5d23-4530-a7c8-40676e7dc160", "value": "T124930A41F9418B27C2D237B6E79F425D77365A24A7D733016A386EF42BC678D2E3A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412835, "uuid": "26f6c103-9a43-4f82-a201-e66b9548948c", "value": "1536:wm2bvK9HYneWfItvCuCkyK3ezxEO1vJ5PIqR3+sSmRPqQ4b/XAhhYQ:cKJYniXCVzHJ5PIqR3omRPqQ4bvAhhYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412835, "uuid": "5d58538c-ebac-411b-bc3d-93f7d86738a0", "value": 93818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412835, "uuid": "8ac6494f-0180-47e4-b178-f4dce54059bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412835, "uuid": "18cda0d0-296c-4487-b251-2d948f2911cc", "value": "0e2a4af8d35ddc10e344d662a52ad6ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4940067-25a4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633414960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414960, "uuid": "7288c8fc-cfb6-45f5-9d14-10e50165aea2", "comment": "Malware payload (Formbook)", "value": "ead1f1b4323b0be54e895624429fe4c7", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414960, "uuid": "545bdfb0-0fd3-457d-80b7-c34f84075ba4", "comment": "Malware payload (Formbook)", "value": "378ee60fb2d81639f413f10e21dbb12a052d37fd5e1c56bc160e9a9ad7351e89", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414960, "uuid": "d1fa7808-35be-4d33-9345-3b77312acc1a", "comment": "Malware payload (Formbook)", "value": "708fea766c6b910cd2951991808ab9123dd9066b", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414960, "uuid": "62919941-da38-4c4e-aab1-ded288e14087", "comment": "Malware payload (Formbook)", "value": "9f78241bb33aee3639247dda0de3682f11a9f68483b7c94c225899accfb0b979279c1e6b81744a931e716bb6c591fa04", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414960, "uuid": "17e7b672-fbc6-4deb-81f3-8a713c2cb814", "value": "T197F4C061B743EA07CE754BB218ADE610633AEE111648C32F3889B67C1D73BB4165C9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414960, "uuid": "e1de5c9e-925c-44de-9df7-c7bc997f7eaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414960, "uuid": "bb4f0017-fe83-4052-a295-fb08e725280e", "value": "6144:NZAWqtexxYrpe6pj1Yx6wHsl+OYvEIj+FjZh68LnvNLLBEj2qaFYhzLEPQ+3HwO6:Hq7Nr1eykOYvfiPFnFPBEj2qaF2do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414960, "uuid": "d9b34452-e297-469f-a037-79ddc3c3ce2a", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414960, "uuid": "9d32ad74-de62-4c41-8d5a-652e53ac2b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414960, "uuid": "a42b1900-daf2-4fbf-9042-e0533462ebb3", "value": "solicitud de presupuesto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2fd9b3-2580-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633399561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399561, "uuid": "267635fb-a672-48d4-87ab-3ba8a576046b", "comment": "Malware payload (Loki)", "value": "cdb5a1d170c38780891139bef8621bc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399561, "uuid": "96a1d7e9-68c8-40aa-889a-d1f9baf28129", "comment": "Malware payload (Loki)", "value": "379ae19e0303f851845bcdd25c2322755434f552e0aa476ebd1337a917dcbed1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399561, "uuid": "963bc9e2-4a59-49df-ac5f-18940d04a235", "comment": "Malware payload (Loki)", "value": "9e7c7797282ec7aca1eaf20fbc4b4b630423f40a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633399561, "uuid": "a2a6241c-d8c2-468f-be49-9a86dd9211db", "comment": "Malware payload (Loki)", "value": "b2a320277d23181c851498a6fa422ce745f573f4b17ebe06fb94ff19f0722bd70b83f022bf54442007f45a93fd6f6597", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399561, "uuid": "fe383e90-f756-4231-b21a-98d9e8c1a2a9", "value": "T19BA32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399561, "uuid": "3d359537-b641-4877-9b2a-dba49c407278", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399561, "uuid": "f003cfdd-8cd3-4e2d-b974-1b72907ee4c9", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633399561, "uuid": "c8f51125-7f42-4d5c-89e5-08248379732a", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633399561, "uuid": "5fb0665b-8201-458d-98de-42ebe26c1031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633399561, "uuid": "ea90baef-cb5d-4aaf-8657-172bb92a341f", "value": "cdb5a1d170c38780891139bef8621bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e15292e-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633416882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416882, "uuid": "69bbd71b-839c-4888-ab81-9baba8399f8e", "comment": "Malware payload (AgentTesla)", "value": "ac548ddb2c6046a30ee986498ea52c44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416882, "uuid": "01d8571a-76b7-4933-b3fc-c51da7ed1fa7", "comment": "Malware payload (AgentTesla)", "value": "37e0ad28ce2812fc6aadb3c8b9ef8e95a843ddd4fa5fe2d501d2b2f0e566e4a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416882, "uuid": "e5c4c494-e3b5-4c99-b965-2c6a3d9f2128", "comment": "Malware payload (AgentTesla)", "value": "406d65eba79b3cd24d14bff3ed2fa11aa4a61053", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416882, "uuid": "61fa0558-f09e-4e8f-a135-9c0945195b22", "comment": "Malware payload (AgentTesla)", "value": "400440abe2a629a322a866926930966c1a1a94b41b335bfd74dd174ffa7eb492e9871c68b87130b8b3192ceed302d8c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416882, "uuid": "b2659ff1-82d5-4613-a616-42be93bd0a37", "value": "T1A664128DB4A8424FE4F7137813779D2814A8DCE06A9F143A99F3FB8A97719C3D44A702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416882, "uuid": "b1ab9dc2-ad84-41f0-8959-41ba9d8f6ad1", "value": "6144:K4Ot+btDwGcecMyNhTU+O/4uZ0DAYhW1YdcUG7VBitq1G7eDPcLr9HF3s:ltUGcTMyN+LsDAR1EG6LeDID3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416882, "uuid": "51f8d3a2-d0ca-4496-b97f-97b044b003f3", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416882, "uuid": "74ea9d0c-c0ad-435c-831f-0f0d268b9e14", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416882, "uuid": "9d441ca9-a643-4116-b3d1-b159cc1fc281", "value": "04OCT2021-USD-178,750.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9acb36-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436960, "uuid": "f70e7eac-d2d2-4b5e-bd0d-68195377f052", "comment": "Malware payload (SnakeKeylogger)", "value": "ab0949b21452f812ec2faafa561b25cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436960, "uuid": "c4518465-64b9-4862-8ab0-2f5b6f3d4232", "comment": "Malware payload (SnakeKeylogger)", "value": "38beac6f9193c7d10ea880cf07d4c672528c6a306b994e3d7c8467bc763d51bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436960, "uuid": "57a12678-2843-414c-972b-393a9c9c1551", "comment": "Malware payload (SnakeKeylogger)", "value": "93b04694dd775721ca9964924a767e3242d94a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436960, "uuid": "0cdfd1d7-9ed5-41c5-bdaa-94788740556a", "comment": "Malware payload (SnakeKeylogger)", "value": "0d3164814b4693f245a2cebadea9be23250cad60b2706bab5e38eb72865698530cc13df7fd936db88cc79f9e6592b54d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436960, "uuid": "1411a6e7-887e-4e15-a025-709760e107c6", "value": "T151C4A4D053CB98C4B57B2539B0222CEBB47D630DF3AECF1151977A938CBA790561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436960, "uuid": "08b8dc11-f600-4c58-9179-db17d0c36f3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436960, "uuid": "e1aba969-880c-4a5f-b43b-a6eb92713f7b", "value": "12288:KW8PI046Mnq0UnsO5lJkKzUvoPUu9YtdIO+M6ejHLtnv9a7DKw49Vp:KxAeOhL+q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436960, "uuid": "51b34975-ba9f-471b-ad3b-313102d9277d", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436960, "uuid": "6a11a0d2-c448-4acc-8018-24e27291fafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436960, "uuid": "8e637e29-b608-42b5-b529-9a44a76ab4b4", "value": "NEW QUOTATION REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f310658-261a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633465632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633465632, "uuid": "8e23c1d0-9bc9-4d97-9402-8cbd88864806", "comment": "Malware payload (RaccoonStealer)", "value": "0047eaecf907d34041b118daa8fbc16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633465632, "uuid": "bb5bebc7-3368-406a-bed6-da9c45f0d0f6", "comment": "Malware payload (RaccoonStealer)", "value": "38f6bc7b4393548db38bb683bb93d7a35fd026cb90744fde7de1ba43a9890678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633465632, "uuid": "ecddac02-939b-46f7-93b7-90a81c8e641b", "comment": "Malware payload (RaccoonStealer)", "value": "f3baa200f5f346d08170c4147e7e579fea5f1302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633465632, "uuid": "1501061a-1668-476e-88d9-92cd5764d961", "comment": "Malware payload (RaccoonStealer)", "value": "75d5131c17ff1f3d4362b13a84bdea129d03dac6a67695c55761e406a421de2e8c9182d8af2091941db11769d58daa13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633465632, "uuid": "2851634a-fd4c-411c-b26e-c4d1c52e1ecc", "value": "T1EE549D3067A0C035F5B702F855B6937DB92E3EA1977490CF92D42AEA46386E4EC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633465632, "uuid": "940542a4-acfd-4211-9ece-6e327ec661c5", "value": "9b1a8118ad0b5e9a72536548770ec8ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633465632, "uuid": "56ee5890-b32f-4e33-a841-55225fcf14d2", "value": "3072:z+P7Er3HJjaw/e0EfNUD/1FlAU6F97qH+qr08ESBuBNeaKWxaVBt3yYLWh7kOb6Q:z+P7WZP/e0aA/FAU6F9q7AxTG66Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633465632, "uuid": "4cfccd72-af71-46cb-b461-1bf073e9c79e", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633465632, "uuid": "b7e5972d-97d4-4819-9643-06ef4e15f3a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633465632, "uuid": "5e21df53-b14d-4056-9331-0b069f5a9a85", "value": "0047eaecf907d34041b118daa8fbc16d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f98c62-2598-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633409753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633409753, "uuid": "897368a0-c956-4ae7-b838-5538057e0585", "comment": "Malware payload (AgentTesla)", "value": "dd34d67dd51995a69d89f8e3c10f4d8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633409753, "uuid": "6e1c166e-17c0-47a6-a471-9358bd7e92ca", "comment": "Malware payload (AgentTesla)", "value": "39d6538d17f4e0983148dde9c80565090d7eb512ad3ea31d9fecc3c9d1530208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633409753, "uuid": "849a822a-0d59-45f6-9b8b-bf94ded77e78", "comment": "Malware payload (AgentTesla)", "value": "ee8b35798bac9ddc82f111eec49708d0b1ee541f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633409753, "uuid": "692ece2c-ad91-481e-a1bd-41700f2aa2b1", "comment": "Malware payload (AgentTesla)", "value": "4cf00dafd3895f4027bba8b5c5649a5d80e07b00062df8b5af386903907585c3de6838ad0326eacbd34cbcd09fe34703", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633409753, "uuid": "5c714a4b-5d4d-4470-b4fb-44a9fbd924a3", "value": "T12DD4D5D053CB99C4B57B2538B0222CEBB47D630DF3AECF1151A77A938CBA750561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633409753, "uuid": "b0d31b85-5bff-428d-8ccf-5d4e336ca799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633409753, "uuid": "fb26f92e-2f4a-4602-a0d4-ce634d98252b", "value": "12288:/WHfdI046Mnq0UnsO5lJkKzUvoPUu9YpoKUJF5VjgGDlRaZ0Ix7hkb6nat:/Ua237VRwrxtnat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633409753, "uuid": "c9afc995-90f4-4614-9610-f857a833104c", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633409753, "uuid": "3b4cbb0d-7e3e-4270-8917-e5b363565c19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633409753, "uuid": "de3bc226-b302-4897-9b5d-9a79a7707ad5", "value": "OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018cfe58-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "4eac71b4-1df0-4c2b-94e9-5816ea11e132", "comment": "Malware payload (Gafgyt)", "value": "7e98ef2fc59b1f7b76b08df22a8f7c24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "fb725cd5-47b4-4208-847b-1cd626a14e73", "comment": "Malware payload (Gafgyt)", "value": "3a55ccfec2a2d08373d579281e5bd205348cca8c70c7575b9bdf1d1dcb6a1bd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "7e8aeb64-02ef-43f5-9ccb-0e9885b35e61", "comment": "Malware payload (Gafgyt)", "value": "c9b7ceb420f0471fb4305620a8a0d1227d2d377d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "40850529-77a4-4803-b685-4e49fdcc42ea", "comment": "Malware payload (Gafgyt)", "value": "b5cb92b10bf6ffc7a078aa5e5b9821d8265c563eab62683247f2c2b00f8ddb97ee5468c54121a16984d0e484a01d0313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412110, "uuid": "98d41ee7-460f-4c25-86f9-8199a343b62d", "value": "T13DA329277B230E23C0C9547112E30331E7B5D75A38BA5397B9D02EAC6F1AA8435277E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412110, "uuid": "0b1b8691-4a4c-4c46-8bfc-a6cd68da216e", "value": "1536:hCHhlDvmniNM5atitjNO9cmQ0FqXjetRea8Q:ghiiN8pDO9cmQ0FqXytRH8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412110, "uuid": "22d3e0a8-9ede-4158-81a4-ffd2ac3ec99e", "value": 99079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412110, "uuid": "d0d634ca-6390-433e-8047-d2ec72ec08dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412110, "uuid": "7f862439-97c3-4551-9cc6-3fef068d4d51", "value": "7e98ef2fc59b1f7b76b08df22a8f7c24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a681c995-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633424412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424412, "uuid": "90eef7c7-0afe-4336-87e0-dc1438d43f63", "comment": "Malware payload (AgentTesla)", "value": "a8495e509d6729a2c0b600495b63d308", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424412, "uuid": "d97a988f-c086-4180-87f7-bbfa2ebdb011", "comment": "Malware payload (AgentTesla)", "value": "3a65563682d5f974fb3f64cbc099a9c2077498245cf82b7b0e218685696344d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424412, "uuid": "ebfff0ba-7796-4559-af4b-6cc8eed6db37", "comment": "Malware payload (AgentTesla)", "value": "7a75112745a602ec27962b2f285d0c4c6cd00bb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424412, "uuid": "442222f9-4163-4c88-ad61-974893cc5da7", "comment": "Malware payload (AgentTesla)", "value": "5e63b4c4a5b6526c711b517245ed278d0206a7908072352e68dc9629e943612f5acb8bec21a643630c92196d40950bf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424412, "uuid": "7f2add9d-9e0a-4498-879a-c7bf52641aa6", "value": "T125842CC3B680A50ECC89A57F7B15D8D8B16DFC46682867ACF250734EA63E166D4313EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424412, "uuid": "ffa6e902-5406-49d8-81ee-4c952c08f655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424412, "uuid": "3f3b25cf-3463-44c0-8a16-7c9bd0434ba5", "value": "384:vpm5+DOItbnC5pYi9Q02UMjyFbDZFdPljzR6CSnUMi74K17N5pNfXd72j6dqt3Oz:vpmQKeDG9oeFbBPljzzTMi74KkeIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424412, "uuid": "b4b2b676-2975-490c-a4e5-2341d0175bdb", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424412, "uuid": "7e64fc8b-c473-4e38-80d5-591ca020cecf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424412, "uuid": "0bb6d5e3-f86c-4b94-8344-5cca7cd6ab75", "value": "Pdf-WA051021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75849dbf-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633441081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441081, "uuid": "fcf98485-fedb-4bb7-a524-95f976b69dc7", "comment": "Malware payload", "value": "d7ac3b5f11b7def8f3eb98e15d940e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441081, "uuid": "7b0b5908-6897-4973-ad85-d0d0be0085d9", "comment": "Malware payload", "value": "3aa871008505a6cb53084e4ae82754bbc0c81c401a41f1acd6b01f708840cb2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441081, "uuid": "c7d4deb3-01b1-4b80-801e-3d6d9e9bce47", "comment": "Malware payload", "value": "b915567417f1b7ffc9cba63681e2b2197f437118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441081, "uuid": "cbb3db03-146a-4e6c-98c4-48479c339efc", "comment": "Malware payload", "value": "37820b25d116356897a0c2de9da4ff999119dac0a7c240bba74b1e1c9c331e3b33d4bc6d735a375ad7ae14efa01d5d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441081, "uuid": "9cd11ad3-d9b8-40e0-ad0b-4be22bb3e1d7", "value": "T16D949D11F28DC1B1E45A2CB8B4AC936662B27D28177CABF3E7607F0899732D47C31916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441081, "uuid": "c69d39a0-66e7-4831-a862-53a5ad12b102", "value": "547cd05356c429dc57b17bf0fd6daf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441081, "uuid": "308f6f08-a25d-4b15-ac49-8a4fbfe40272", "value": "3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoy:JjqVG/pJZzfwsGX+LOODn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441081, "uuid": "9b56932a-a6a8-4cc2-ba04-6b443f20a20c", "value": 428533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441081, "uuid": "ecc219bb-fa00-4be8-aa7e-5017163cea44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441081, "uuid": "5247e880-c06e-4689-a8f2-50f2adfc9e01", "value": "Update-KB250-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd51507f-259b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633411244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411244, "uuid": "511f9c69-28dc-456c-aa29-9d2d6945c2fc", "comment": "Malware payload (SnakeKeylogger)", "value": "81bd72b68994a4c766791ea3234baf11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411244, "uuid": "b8364d73-1bde-4dda-b34c-2512179c1312", "comment": "Malware payload (SnakeKeylogger)", "value": "3aba2f4a6929b0130cbc9981637527999c3401e4f0da58d3b91d2a62b58eb22f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411244, "uuid": "df076b52-6301-4efb-aa46-2327dc8d37d5", "comment": "Malware payload (SnakeKeylogger)", "value": "21b44a46bedb3159893f8f43ce2dd72b6fb294f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411244, "uuid": "42af1846-836f-4bd7-9704-f1dbe4965973", "comment": "Malware payload (SnakeKeylogger)", "value": "90f2dbac36c2cdf14c1cfe980b934ee8229f5591e7bf78ee86a9708e0b57c0c3b0c78bb3131aac01915debb6aeb88640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411244, "uuid": "8b2e05e3-3be6-491f-a6af-8db97091a22a", "value": "T1820593D43386B5CDF577D239F4101CEAF9B8311EE31A8A02A0272AD68D6C642EF2D5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411244, "uuid": "406e34fb-72ad-4514-b453-b2e28073dd96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411244, "uuid": "e183a1c5-ac2f-4db8-a190-4861ec3a9f27", "value": "12288:iTZM20Rit36qnoN2tQ046Mnq0UnsO5lJkKzUvoPUu9YqwiQjw5tRBZq2Ekyx/eRb:gZMHqwiQM5xsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411244, "uuid": "1e5bbd22-bdf5-4bf2-9a4e-b95b1dd034aa", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411244, "uuid": "605952f6-3249-4e11-9d57-efc298a380ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411244, "uuid": "1d8e61ff-632b-4edd-b1b1-704685ae6d0b", "value": "68765578980878 - Purchase Order_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb9c8e5-25dd-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633439561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439561, "uuid": "b3f6caaf-dce9-4d10-841c-7957ceed4a46", "comment": "Malware payload (AgentTesla)", "value": "233639b7806e58ea6da9bd42063cd468", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439561, "uuid": "73286ea1-d2d7-4470-bac0-57c21faa61c5", "comment": "Malware payload (AgentTesla)", "value": "3b57b2ccf6fedab424f0cbc0e0dea0d9ee1ea45c346825a526c93cc61dfc3701", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439561, "uuid": "4f5457a1-029c-4d7b-a8b6-ecf02ca7d005", "comment": "Malware payload (AgentTesla)", "value": "2bef9561aea3e3287a9d5c68a533edf62c75e118", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439561, "uuid": "9de88e69-eab3-40fa-ab66-4e84415d37ad", "comment": "Malware payload (AgentTesla)", "value": "5f4385fdf236a62df8312ff5e7ffd80a7b4b0350eeb70e01786e2034a6207d91c2498dd8f2fe95a33b72b7086db72d58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439561, "uuid": "57255783-ae51-4065-b015-5bba121bcc00", "value": "T1A3B4CF9823AF5B45DD785FF4256C91D143F66C37217AD3290ED5B0EA2D22BB00E90BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439561, "uuid": "b393ac1d-64ee-4d35-9294-3c630f22edb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439561, "uuid": "1c779f97-27f3-4b4b-b176-75e712d9c726", "value": "12288:amNUocc0WmqbN0novx7gunmIb5/9+9m4Q4JHeobvFmTZIia:3Urc0WzbN0ox7Nnl/9PCge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439561, "uuid": "44c828b1-0d8f-4dc4-845e-7824ca580e3d", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439561, "uuid": "d2e3e39d-8af2-4e8a-a079-3c3e9aa3c535", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439561, "uuid": "07eed2ba-49b5-4819-83c4-a0d41a86078a", "value": "Invoice20210510_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f260ec-25be-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633426017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426017, "uuid": "fbc64a5e-94ad-42b9-a5b0-0ebaa5a06c32", "comment": "Malware payload (AgentTesla)", "value": "ddea72b85b45a27f07c23efe6611ca85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426017, "uuid": "5f28b019-122a-4766-b5ec-c2c39b61bc3a", "comment": "Malware payload (AgentTesla)", "value": "3b7070739c07ae5e0cb4d7d49c81602d9f55bfe65c60c68d566b4eb501daa5a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426017, "uuid": "f82ce363-80cd-4585-aca0-05d14e432b31", "comment": "Malware payload (AgentTesla)", "value": "649e3bfeb2df29cef40c02c52f0a83268c71f1d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426017, "uuid": "e26328e4-6b7a-4e5e-b620-daa447a40b7e", "comment": "Malware payload (AgentTesla)", "value": "c6a94abdafe81fbf0a272e332427e7f65cd9ffd9c9da89bf23bc5e5391b9d876a5a968e248727c25a595d2b037edda03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426017, "uuid": "9e8b5c80-ff7a-49bd-801d-9c5945839f3a", "value": "T12BB4DFA833AFAB05DD398FF4151C91C293B66C371169D7390ED5B1EE1E22B700A91B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426017, "uuid": "ca43549a-5509-428f-943e-504fcbb420dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426017, "uuid": "8819f2b1-89ef-4574-bd63-90f50fe4ef94", "value": "6144:ZOPAbbOYRzfhnhTQ+3HwOcc0WHW0CpkYags0QQQME6ZXnDfi00hORy201+wzel0l:Xz/0occ0W20Cpkh9SEWXn3Ie4drR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633426017, "uuid": "0d71d7a3-974e-4c76-b5b4-6df01939b671", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633426017, "uuid": "96c791eb-aa10-4750-8e19-b5c57f06a075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426017, "uuid": "be9b7ccb-5251-4562-9868-4f975a25902a", "value": "PO09858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b25d18-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "396609a8-7da3-4a5b-b36a-f84be48a00eb", "comment": "Malware payload (Gafgyt)", "value": "49e0ddf3c4492b569a16e216588027a9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "7343e010-609b-4e2e-8027-82e10e9a96c2", "comment": "Malware payload (Gafgyt)", "value": "3c9b46ecdf1e894a873e9334c40b743b84c32636d100b2121dfed9e64ea0b893", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "8755b469-b0c5-468c-beba-3e9fd41a665c", "comment": "Malware payload (Gafgyt)", "value": "b0805135bcd97e73dc01f5097fe3514a9354d793", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412110, "uuid": "e617861e-8466-46c6-9859-590354db4fbe", "comment": "Malware payload (Gafgyt)", "value": "ec7e103d48f7dcbb0c9fca43eb1fb91b738b64db4514d963f185c2bbb732fc8bc9c7fb360f65143393bed53a714e4593", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412110, "uuid": "e6a8fc79-78f4-4f78-8638-f13a07d3b978", "value": "T1E3934B23A652C67FC0C796B42BEB85219423B4390F37725A73E47DE92F169C92E5E301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412110, "uuid": "9ec197b2-e46f-4d4b-b745-a11c7c10a04e", "value": "1536:817HBry6rXyJ1NL1JWP2+oGEte4ssd33oMVx8lxAmoIVuOVjeDlOXQ:8ls6rCNbWPeFzssdnoMVx8QmrVuOVyDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412110, "uuid": "1ff426c4-ca4f-4c72-82a5-63ae017f06a3", "value": 89435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412110, "uuid": "1c95fb7d-ec1a-426f-b255-5a2608464f4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412110, "uuid": "503c7bcc-d179-4327-956c-1a919c3f3670", "value": "49e0ddf3c4492b569a16e216588027a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a89177-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633437323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437323, "uuid": "be287baa-a9e1-4ee5-a74e-35e2bf0a778f", "comment": "Malware payload (Formbook)", "value": "cb5ac03dc672ee89f703ae55ab91d127", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437323, "uuid": "78137fa9-412f-4f0a-938c-129be0136a74", "comment": "Malware payload (Formbook)", "value": "3d50ba30807f81375a600fd216d4130bc61e08d6b697d61c31622c33b2b10ff0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437323, "uuid": "c95520ea-37e7-4c34-a0f1-2133f464aea0", "comment": "Malware payload (Formbook)", "value": "23e006b8d9c87c6650b504f83600622cb3b35c1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437323, "uuid": "cc25a7c3-fc27-4f33-ba9d-8c6e9e425980", "comment": "Malware payload (Formbook)", "value": "7d056c6bb83f8d7b64ff00a98c60a2365b9fce4cb7a530281524b0b7ab8718312bd81e69c4ccc464acd33f7176ebca33", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437323, "uuid": "fd788a9f-3090-4a7e-9a4b-10bdef7b7169", "value": "T1B06423207D0E734FE2B3B97F8B6181B864CBDE2B92076596A5253AD57434FC0C5AA04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437323, "uuid": "9319c240-883f-42ae-82bc-4c759c6f8f5b", "value": "6144:c45flNTsD2vuS14ZBsRswxDVrs18MyNpbefLjoEGmi/jdRlvVNKp234ofw:c45XT5i2HDVC8Mceff5Gm+RRKMoyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437323, "uuid": "01708c8e-a92c-47de-9084-6d2b8676cce5", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437323, "uuid": "3cd587cb-685d-4b14-99be-81d894c91c3d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437323, "uuid": "ea11c1e3-4092-4596-bfeb-94cc61c6489b", "value": "NEW QUOTATION REQUEST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679aeb30-2632-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633475847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475847, "uuid": "da5a7407-082a-4906-93d6-639702b71651", "comment": "Malware payload (RedLineStealer)", "value": "7744729a25a46ba8f1c3b1ce451dce0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475847, "uuid": "c1782dde-f96b-46d6-9f68-75b549f7b1c8", "comment": "Malware payload (RedLineStealer)", "value": "3d956bd7b7e1c1e253b997de0d325abeba7be7d75626d751fad5a28ec3c464a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475847, "uuid": "e377919f-f130-4cf8-9d81-48fef00535dd", "comment": "Malware payload (RedLineStealer)", "value": "c2d23d94760223306cd040c0a0ec0440e0fe839f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475847, "uuid": "24efef9e-56cf-403e-81c6-041658a95faf", "comment": "Malware payload (RedLineStealer)", "value": "5679fc5c7d21a8746a3c671cf7d0e017bd3a54a50f16a9db4f4722e42e9d730bd0f02bbecb22927bf3693a6d1f55f596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475847, "uuid": "86efddc8-c3b7-4c66-8780-a01faca6dcac", "value": "T1652633507EE1C4FBD903023487986B2530ED8BA9953106C773A0E72DAF2E9E6D11FE59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475847, "uuid": "60578737-8fdd-49ed-a4fc-c4baf7d3ba4d", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475847, "uuid": "9e74024d-e613-43cf-a3d0-6ad6a7a2492d", "value": "98304:xhCvLUBsgogsBJy7c7gA9E9hXFkPIBKSOQmzhDzq4cEH:xqLUCgdGfgAaxNBVOQmzZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633475847, "uuid": "9572f33c-03ad-434a-9890-0e552cd7e9a7", "value": 4431915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633475847, "uuid": "1b7e7362-b72c-4032-98d1-0babff0ba83a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475847, "uuid": "96ad02a6-c506-4a1f-95f3-5b365f3ac7fd", "value": "7744729A25A46BA8F1C3B1CE451DCE0E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ffc3ed-25b7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633422955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422955, "uuid": "b1aaedcf-cd3a-4617-8e40-f0ed39e3f17e", "comment": "Malware payload (RedLineStealer)", "value": "ed0a7d46a18c02e8e781f7e31e3213a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422955, "uuid": "85a73fe8-6c6a-4ea4-a583-d4c2abc2715b", "comment": "Malware payload (RedLineStealer)", "value": "3eab904378106422ddb6fac7d20dd694919c0b69fe09231435d781e0f1507e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422955, "uuid": "e125ac54-3f3a-4cff-a910-b83620e48827", "comment": "Malware payload (RedLineStealer)", "value": "6a2bc07d54d303b402047460a9e4f72dead04227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422955, "uuid": "c5b096f6-86bf-4126-8fe9-e227dbc03198", "comment": "Malware payload (RedLineStealer)", "value": "356dfe87e89380c40466e1f2fba2424ccfe74b805e4de684c85d53abad7c6072fe97c76952ca0d3750061c3aa5b9ead5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422955, "uuid": "89334b0a-97c2-47ca-90f7-b0b5a1ed8839", "value": "T13D64CF1067E0C034F2B712F949B993B8A92EBDB0A73495CF67D52AEA46746D0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422955, "uuid": "0bb1598c-70e5-4f46-9a25-92dd13308685", "value": "64d7f5246a1a432e8ee086e976e37133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422955, "uuid": "7c004b63-bbfa-4636-902c-b69306d2a74d", "value": "6144:K4/o6fwBNGglejFlQwlmhU1b/qZNZ4lQxsf3BT:Km94NGglmlQwlmOdlQWfBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422955, "uuid": "508fe761-bf04-4825-8fa3-1fea20c7a3ec", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422955, "uuid": "da3aebbf-8d1f-4bef-9014-dfdaca0d2b87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422955, "uuid": "a588a992-c708-4882-bfc8-85c274a6b396", "value": "ed0a7d46a18c02e8e781f7e31e3213a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a443a-2638-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633478269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478269, "uuid": "0fb7d440-742a-49c4-b5f5-2c02063be3bb", "comment": "Malware payload", "value": "6634a952b1d18ed9db3a60b0e605d8c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478269, "uuid": "3442cc19-37c7-4ea3-a7e6-a61f60c3c35a", "comment": "Malware payload", "value": "3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478269, "uuid": "d8f0aa27-ab99-4394-9239-fd280c096f1e", "comment": "Malware payload", "value": "556c5876f530719212deb3bdd2d49cdfa9b5bc58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478269, "uuid": "e705854a-3a6e-463e-8204-66295d7fde3a", "comment": "Malware payload", "value": "73e48e143802e7806568d7f5d100219bea86f507779b160ece9bcf1bce6410a1f5c2b4716d44f5a3af501aa3042d3549", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478269, "uuid": "41c0fb07-eb4a-414d-babb-e8fe7d434957", "value": "T17CF423F27F61ACE662077AFEFF169D4EB02159C5E44F4F300DAE088E8C299054B1E956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478269, "uuid": "8131b3cd-b779-458b-be9a-89a299d2f923", "value": "12288:Yvz3zPzJWjGA036wN/4qyqFULsJ8zcoqGYmMRGWbp5JbUbZWioXjgRgse/dByaKX:Y9QGA0K8FULsJCc8YoiJbUckRgsebhAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633478269, "uuid": "01cf48ff-4eb0-4271-ac42-6769f4a587c1", "value": 748712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633478269, "uuid": "a838bf09-53a1-461d-af1a-d68e2f3b8ca9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478269, "uuid": "e3f7dec9-fe43-4ae4-87a3-726b01671197", "value": "ntpclient", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9335b8fa-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633417079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417079, "uuid": "61fe37d9-4167-4103-b02e-1481473d09ac", "comment": "Malware payload (NanoCore)", "value": "72f9dc7053479a0f0255c3936f55901f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417079, "uuid": "22efecbc-5977-4e9d-9eee-ae49edbbc158", "comment": "Malware payload (NanoCore)", "value": "3fe5ff083ba60ea54053f3ae7fb53b073305d99daa35ab4af3b16e703934b73b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417079, "uuid": "1735ef2b-387e-4ae7-b2cd-0e15af86f6cb", "comment": "Malware payload (NanoCore)", "value": "6dbbeddb06e2bff9f83b662b6d471b0e42a0a342", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417079, "uuid": "f4b8dc89-53a5-4f5a-9961-dd9b6fb22a5c", "comment": "Malware payload (NanoCore)", "value": "75d48f7e7bbdccb5346155c6210b1477951c0428421bde59eebdf1ad48d59ade0babf8bd584d547a341b75738f858ebe", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417079, "uuid": "e61c3df2-5840-48c5-80f6-f321725bc42c", "value": "T1F325BF4AB768BFADC26E5F35C113C64843FDD06373B2FA9B2AC84DD01801716895F996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417079, "uuid": "6370a82e-c1eb-4ec9-9062-fbc20d0b68d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417079, "uuid": "21cd09a5-a0c2-4bea-b0af-fcede3b42518", "value": "12288:yM9QJVDnESN0u4G3gvz6hjLy57Mx1ixCe0Igt7oa3KsLSpwTj+zPTKL+:yZXx09GwLUnyWxSCXIg5SpgyPKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417079, "uuid": "b9f91570-260f-4b16-b9d6-ac19092bc552", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417079, "uuid": "631e5239-1958-4fda-8c6f-45f8b73752f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417079, "uuid": "2b9b736c-e46c-4258-a5a1-43609a6d9fbc", "value": "DHL_Shipment_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc53bbe3-25d3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633435294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435294, "uuid": "08be8c9e-db57-4f28-833d-5081deae695d", "comment": "Malware payload (RaccoonStealer)", "value": "f2af0e6190c27e0e6685285c8b7ae0aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435294, "uuid": "211c1683-85a3-400f-b40e-d823e8b7de07", "comment": "Malware payload (RaccoonStealer)", "value": "4028b39311179a65dda13e94e2b04832b8733b3138c88f4adb91eb928d15cfd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435294, "uuid": "8fc9ded6-7cad-43b9-9acd-19633053bf00", "comment": "Malware payload (RaccoonStealer)", "value": "a795f4f48ded812e905f9ed9b4f7356c840b5a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435294, "uuid": "521c5b90-e5d3-4561-adca-debc177a29e4", "comment": "Malware payload (RaccoonStealer)", "value": "bccaf90322e52b089bf3711ada6268a434447b4cb3d0eaab39921798b3c5e4c6a30b38df1813211202bd1cc93f65e8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435294, "uuid": "8011bda8-c47c-4dc8-bdeb-c839b557b36c", "value": "T106B4E110A7E0C039F2FB16F608B593B4A92DBDB06B34D1CB66D11AE956386E0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435294, "uuid": "13b37ad9-debe-41f5-8cec-e41d758a399e", "value": "bec5279be0cb3c653f5b0b143b00a99c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435294, "uuid": "0e4a6952-12b5-4176-a0b1-28520254d8c1", "value": "12288:RjQYegBLnn/9iwaezyIzYhDrKVk48zS3mLxl:SyLnFVaeTzYhD+VN8zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633435294, "uuid": "a024fa9c-74da-40e2-b9a1-8b26a6eb5a89", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633435294, "uuid": "01c9cbfc-c5a9-4834-8a31-f5aa1add9408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435294, "uuid": "15def107-3208-4724-bdc8-6835c67c9c0d", "value": "f2af0e6190c27e0e6685285c8b7ae0aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178312a0-25c5-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633428897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428897, "uuid": "d3239251-eb86-4268-b4ae-c35395b4e238", "comment": "Malware payload (CoinMiner)", "value": "3ab2c790255aaeb328042c08a8ded716", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428897, "uuid": "c4ff1ad4-c2b7-4335-a253-2285b3e3c74d", "comment": "Malware payload (CoinMiner)", "value": "40632f3f01035117faab6039b820848825ff839b472a02f11827784b428ac3eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428897, "uuid": "8228aec9-3562-4364-8899-64c1bb34fdc6", "comment": "Malware payload (CoinMiner)", "value": "f1abac73efa2ef4fe098b22ba43b1b7ef280f5fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428897, "uuid": "57b775b9-2203-41e2-b85f-b65abedd8f6b", "comment": "Malware payload (CoinMiner)", "value": "cdda2386351d6659c84c919b2e46973ebc0d0b86cc120c2890d4cc0d9cf4559c84dc17da7ada7e8e5ad1708503dcaabc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428897, "uuid": "07949180-4833-463d-a912-0e73319df8c7", "value": "T12896331934D545B3C2362AB22C68DF2621A1B9242F009FD5D3CD1BB9A7713F1EB39762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428897, "uuid": "80ffa866-df36-4cb8-a1e7-d9f194a73994", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428897, "uuid": "24d1fc8c-afec-42cf-bdb1-427adb42adc3", "value": "196608:Rny7oqJvgcH5VopN9htDTi8g2oqA1P7D416odVJ5BUTCnc:JTq3OrtD2L2oqA10p5BgCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633428897, "uuid": "1236edc2-c18e-416c-8a26-7572af65d634", "value": 8997599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633428897, "uuid": "29e1d2bf-9b38-4241-95c5-d87ea2e22776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428897, "uuid": "9027eb87-ea17-4fba-81d3-443634009dc6", "value": "3ab2c790255aaeb328042c08a8ded716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad1765c-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633416903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416903, "uuid": "1cf01231-f0ba-4096-8152-ea4067c40bec", "comment": "Malware payload (Formbook)", "value": "e2b315252157a66a14b1e2cf16f48d13", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416903, "uuid": "a02ce47c-e338-4027-9af1-5562e36fbeed", "comment": "Malware payload (Formbook)", "value": "42026613727bb0a3abdb27bd89c11d1f20fadaa7c230bbbc32f201c391b6110a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416903, "uuid": "2f2e2129-cf81-4234-8d5b-164514c4796d", "comment": "Malware payload (Formbook)", "value": "ace275ccb607513db5d2625008302b5d327ad888", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416903, "uuid": "2a2d1b17-f8b8-4f7f-8598-883086eeb801", "comment": "Malware payload (Formbook)", "value": "879faac6218e5eee9f367a3b4ba27d1d19ee15114f69f44fe1973f891ed1f48acb2a9cc6c3e5c4bf0a796438f02f6e8a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416903, "uuid": "1edd69ed-c286-4025-b4a1-68bb5a6ee308", "value": "T1EEB3F10654A8AA04E0CC9BB91474F66D13F25F7BC9A2874BBD4AFF4C4DBCA505C5243E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416903, "uuid": "6248e399-d4e7-4b92-bde2-cdd1901fb72f", "value": "3072:H4A9p5+hPBHp4HiRGws9n5PsE1Z4EAcyJZhkm3ytX5arJ:tMHf05shXjZ6V8rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416903, "uuid": "fff72d47-a73d-4b15-a0d5-f084382327d8", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416903, "uuid": "d938e501-8b76-40d7-9619-78eefa183494", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416903, "uuid": "dac84d68-b121-4905-a786-df039ed0d1f0", "value": "PO#0025929 2021_10_5 Confirmation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2f79eb-25e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633443103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443103, "uuid": "8e677c58-7279-4d83-9616-8e2fa2071ac9", "comment": "Malware payload (Gozi)", "value": "aba803fe6d032e51c8bc364173a19c20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443103, "uuid": "4c85b6f5-d414-437c-92ba-f8272b29b6af", "comment": "Malware payload (Gozi)", "value": "424539700d74c045f668142ca54848fde11e2859de07927130fa06a074139aee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443103, "uuid": "e40da8fe-4b21-43cf-9b3d-0916d4a03e96", "comment": "Malware payload (Gozi)", "value": "170cd375f8cec823a632db24b6efd9a9f8e32b09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443103, "uuid": "4cdc1df6-91eb-4173-b4d5-4a59cc7c9931", "comment": "Malware payload (Gozi)", "value": "9edaa5d467abb7da8c7859ca60224bc4b2712c353312e512f1c3ca0b34441617a89a3cb5457da18359c5e07102059a98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443103, "uuid": "c5c7d41f-d8eb-495f-97b3-b61bc0eaff6a", "value": "T1D8E430443A54F510E6AD6972CF2AC5F907157D09EFF1B48B78E03E1F2AAE8A3D516302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443103, "uuid": "1e382872-7f85-469a-b615-b275014ff761", "value": "8d2de2ae605a2294ac6efde10e33795a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443103, "uuid": "1d4855b3-7884-413b-9fcd-0e8ae3b17c60", "value": "12288:6vWBEPfqPoo44cvquI2Pg/8wsPrcPgIDU1Iu3vEI8Vck+5gS2oQkoKeyFtseQOYc:6v5Pbo4ZgaPrOpI1IkvIVc1qDoQko/yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443103, "uuid": "8ed14f25-cd95-4c18-af05-de22720332fd", "value": 676593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443103, "uuid": "5a0fea56-8fb1-4e6d-8781-5e0cee4aa1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443103, "uuid": "29c25a54-c472-43ba-8c5f-6ee61a6654e1", "value": "test1.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85104152-25b4-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633421779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421779, "uuid": "df86823f-986f-49da-a259-6f264464c1d0", "comment": "Malware payload (TrickBot)", "value": "4600a1e238c15ee784bd7ca38db3dc2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421779, "uuid": "d4582c53-c847-40f1-a80b-4b35a1b7cc8f", "comment": "Malware payload (TrickBot)", "value": "42d570cd852e4bc909f7b72cdaf45b43a43f32b07364bda976e2b00ee9b385a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421779, "uuid": "5b56c86c-acbc-4822-a8d8-f7bb52e83a32", "comment": "Malware payload (TrickBot)", "value": "83289e7a1f655cf27c54575cc41e22f02013deed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421779, "uuid": "69d6d1ca-773b-4747-a4c6-cc91f6fa2f8c", "comment": "Malware payload (TrickBot)", "value": "b177e87934b135d0ad8c5f8e67c3b9d78f5004a969f3ab958b92e44a5278f3d0168e373101c78c7006e8920bacedee8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421779, "uuid": "034895a4-8467-4921-9837-22080d303d09", "value": "T182B4F1023AD584B2D962253209EAA73FB7B5FD458A32CF47A354FF1DDC30141A92B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421779, "uuid": "bbfe55e8-2530-4102-9d5d-5f26626c5ca2", "value": "e38afb91bac491f7825e4d9386ac015b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421779, "uuid": "f8850f24-7afa-4aba-a0a6-a01ac59bb1b8", "value": "12288:S1RdEJFGqNkbHfAwK7pzoutmIp57vDGr:S1RdEJFGqabHYNi8F5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633421779, "uuid": "1315f086-640d-4959-94f3-4de4902b1755", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633421779, "uuid": "f49d731b-adc2-4b10-b055-cc06f250522a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421779, "uuid": "5257871b-ee2b-4593-b666-246f4dcbbd65", "value": "4600a1e238c15ee784bd7ca38db3dc2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8a0c37-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412127, "uuid": "25f9930b-64d8-4b4a-abfb-99e576a5c128", "comment": "Malware payload (Gafgyt)", "value": "700e10bd54f8b8601c9c2288d760ed4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412127, "uuid": "b9418cdb-b147-476e-85fa-b4b1644af3cf", "comment": "Malware payload (Gafgyt)", "value": "435da96c1c7128fbaac5b33a1d2d56249953527c342d8fa6d3feaf7f3c707d15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412127, "uuid": "09d4df28-b20b-4877-b949-38310a6f3347", "comment": "Malware payload (Gafgyt)", "value": "3b9ae5c96407c05154c2ae8f700fab5b70a82c08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412127, "uuid": "8d7c0267-673f-45ac-9af3-0f6ed984e044", "comment": "Malware payload (Gafgyt)", "value": "6f5163d2a70352c055b536906f8f1ac928656335a5b7b40f1144268c5f53c14fff1b4df892787083eb407c27f378fe01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412127, "uuid": "ba09c79e-0a48-4a07-9c68-41cc6de1c56e", "value": "T14CA30B01E9418B27C2D327B6F79F435D77365A6497D7330269387EB42BC67892B3A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412127, "uuid": "761a6f37-4903-4fa3-968c-87b7019a425d", "value": "1536:n98LvKd50/jM8D+xZaSrnmO04Orgv/soPnfv/gqfbaTCximCKrQAFW9LhZaQ:4Kr0/h4COT/soP4qjhimCKrQAFiLhZaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412127, "uuid": "ed78bf2a-064a-4a20-8431-549f9c460d17", "value": 100396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412127, "uuid": "8cb0a106-f193-456a-af11-4da10e7bc0fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412127, "uuid": "35648791-dc9a-499e-8c4c-1794f322af58", "value": "700e10bd54f8b8601c9c2288d760ed4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90130ce3-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1633454440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454440, "uuid": "bbc02e33-5baa-4342-ba92-2dc0d2a8c037", "comment": "Malware payload (Stop)", "value": "7d208dd86e75c9c5900a85b08ef0b070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454440, "uuid": "1570b6dc-8ab5-4637-81ec-129bd4dbd0be", "comment": "Malware payload (Stop)", "value": "4380c45fd46d1a63cffe4d37cf33b0710330a766b7700af86020a936cdd09cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454440, "uuid": "a84b18f3-aa5b-41d7-99b7-da284c2c72b1", "comment": "Malware payload (Stop)", "value": "79a453d4e5403307b54205094ded4e5ff0382c71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454440, "uuid": "b7137f43-4496-41b0-a02b-856766af89d3", "comment": "Malware payload (Stop)", "value": "a9e629b730b40801822f31cb9c85fd4da5527a8a3e12414772773899cd1162533b9100fb0016fc31b6ea071f962eca71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454440, "uuid": "b9320713-c334-4732-b6c7-2ba88ef7262c", "value": "T134F4011067E0C034F17726FA05B443B9A92DBEB06B3892CBA6E556EB52745E0ED31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454440, "uuid": "1a585083-4c47-4d8d-bde2-3a296ad0483b", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454440, "uuid": "72c09ba8-5068-4a8a-9743-ac5b1eed0469", "value": "12288:OIgLATm/kOWOkszScYwu8dzcUe38eVMzELqHuiVG/fAh8EUu8GBnEvBmQooPVlUo:uJ8Od35uGW31VM0f7du8XBm1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454440, "uuid": "18dede11-b525-4561-bab9-f40b240ae153", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454440, "uuid": "22a07188-2d5d-406b-96e9-4b7e4fd6d2ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454440, "uuid": "f1c67506-9f2e-4743-aabe-c4b6cb18590a", "value": "7d208dd86e75c9c5900a85b08ef0b070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00852173-259c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633411249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411249, "uuid": "a6e81648-5cd2-47a8-8b31-616ee2582376", "comment": "Malware payload", "value": "482644bc19e091c20665985cb1bccf0d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411249, "uuid": "c9f4774c-5f3e-414f-ad08-6d532cd27c26", "comment": "Malware payload", "value": "441fdc4e964269b6a29fb73a5b8c29f85b7fc6aec6ea3b2892b41b9a4d9d77e5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411249, "uuid": "7802f21c-6262-4bb4-8755-16ffb58c83a5", "comment": "Malware payload", "value": "6f7582224e0a2044612bda88803ff7fc1b2fc9b5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411249, "uuid": "383aa9f8-33f7-4d19-a4a7-b7f1cb16b5e8", "comment": "Malware payload", "value": "34f326d6f9afde66cdbfac10e42acf1591a95efc04c94b5036c5953ba1bcf06689c5d185826d982146f02cc51c294bfa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411249, "uuid": "48cef7dc-d90e-4855-8679-f7445acb316a", "value": "T19BB57D22B2D18537D0772E38CD6B63A9943A7E602E38984F7BE41D4C5F397807A192D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411249, "uuid": "69bf35db-038f-4952-a81b-3d5f9a9c52f1", "value": "49152:i+95EQIdFSCluUD/jQKy5nTPdMMtiTYLEA:hZ8FSkuUD0rROTYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411249, "uuid": "b04afa08-f301-4527-b85e-c31b0ddfc742", "value": 2464256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411249, "uuid": "71fe2b9f-99bc-48ff-b1d5-b2233ba3f589", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411249, "uuid": "84546c66-6aae-40c3-b9ea-e1e72f120040", "value": "mp xjiwbdexzxbrurwqlsorbnyggzxkqtzfdrpdreuzx.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea36c43-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633437311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437311, "uuid": "989834f2-99dd-4489-b862-875994ae5807", "comment": "Malware payload (Formbook)", "value": "8939ca036d4a34cac06589f45a37f1c7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437311, "uuid": "b0b4fb9e-8d25-4081-ae3d-abe633708550", "comment": "Malware payload (Formbook)", "value": "451a4d1d26ee93d502a4585d53bd038a0aedce227e0709cbfacd2862418e164c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437311, "uuid": "44bf3ed4-4ee5-45b7-82b3-436dfbab81ee", "comment": "Malware payload (Formbook)", "value": "c1fc67317b07a7582250eb0fdb40b539c14232a2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437311, "uuid": "a35ea9e6-1277-4124-b7d5-5ad126c6e86e", "comment": "Malware payload (Formbook)", "value": "8b85c66c173838fcc1c352b79ee9cc936575972373bc6776dc33955c8d510b3bd21cb828e3d834394293d281520a49da", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437311, "uuid": "03b3e9ba-1ce9-42a2-b5e9-1d939aedd692", "value": "T1636412767A1C9F0FF961C23649A74441CBF2DC129715286D29C93E0E2AF1B09DCBB47A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437311, "uuid": "7a05a924-8f82-42f3-9a86-6f51b7579bf2", "value": "6144:xlv5D2K1EjgiaB99KPZVxn42cFydn/WaB69b9TAlSGxws47:bvge2gpPKPZz42qAWaB6V5AJxws47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437311, "uuid": "2ccade6d-0b30-43c9-bd32-fabee512b7d7", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437311, "uuid": "e4b8a622-b5ca-4aec-bbf4-b7f95575992b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437311, "uuid": "37380022-ed35-41c8-8f58-3bb74e2b1e22", "value": "10-05-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b792e0a-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633411482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411482, "uuid": "8c85fb33-bb0d-4bba-a09a-27a4a1bbbd2e", "comment": "Malware payload (AgentTesla)", "value": "6ad4b8a2014bebde6655243a4c464c1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411482, "uuid": "6f689ef1-d647-46c7-9e46-4985989ca335", "comment": "Malware payload (AgentTesla)", "value": "464ea199b87ead615bffdd7a52544da4a2c09987800c777dd3a68e18df22a89e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411482, "uuid": "2b317db6-9c6e-4d8b-9c4c-2b0b0540c5f4", "comment": "Malware payload (AgentTesla)", "value": "d90fed75879d355fe75ceee7b53e71e58e151c3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411482, "uuid": "a425a84f-25c4-42b3-ae3d-99c6fe797f57", "comment": "Malware payload (AgentTesla)", "value": "7559dbd5f2902956731b0c0894e9f670f80dfa855f9e35a83b7bcb349537afd02581b4807dfdbe1a1c4ee9b0bde6842f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411482, "uuid": "5515cc2a-81ff-417f-a810-053220cea6a8", "value": "T12655CF64B747D91BCE7547F028AD9240533AAF121A08C32E7C89B7BD2E73B74164C9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411482, "uuid": "94b20816-78fb-4eb8-a430-e3d64357cfe9", "value": "6144:ROacLYW1Q+3HwOExxBHVu2wYNlvZGKshCxi6RELqi3Jr7W9+ECwoSmvYqTu/YYPe:QLGoa1ZNlvZvi6yqi9KOwUT4YjLsx9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411482, "uuid": "5f676910-b50c-4295-815a-e8d7f0496fd7", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411482, "uuid": "69513bf7-dee4-4b83-a2cc-f6b6f5eb4211", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411482, "uuid": "9d01745f-da27-4ea9-84ab-b849af12fc7f", "value": "SOA.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657057dc-25aa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633417431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417431, "uuid": "85c2690e-9575-4519-ad17-c7bed2da2a33", "comment": "Malware payload (AgentTesla)", "value": "72ac15be91b759522fb1e874bb049ed6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417431, "uuid": "ebbefbad-86f1-40ad-93c9-de97201acf28", "comment": "Malware payload (AgentTesla)", "value": "46a4a07e944db667d387682d3b7969bad392a59d4818ca1c258578de30ffcc77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417431, "uuid": "b3d0b4b4-e86b-4a39-ae42-3a49589cd7d0", "comment": "Malware payload (AgentTesla)", "value": "8c09b039f4ef13b3d99ce01996472e26619ff6a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417431, "uuid": "63da4ced-915c-4473-8314-2d812e9829a9", "comment": "Malware payload (AgentTesla)", "value": "a5a8cd61afed4d9d9fe7f30fbae88eb2251ef081bd4678cb61b5459530d8fcca7943416a38a25320c6ab2919043989ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417431, "uuid": "be8a2616-adf5-4f45-9a45-d74ee97a8dad", "value": "T15B64221AB2CA6472E8D31AF24BBD7730B3BF8554061B1F9B07199E1F71465038B9B1B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417431, "uuid": "5229766c-c231-4f6f-a34d-6dbdfe737be3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417431, "uuid": "8dc30ca7-4c49-41ec-98ad-b1bb4b3251dc", "value": "6144:F8LxBs2qS6gRIAGkB6x1CSE5FESbU/rmSttd/jk9vvDjq0o56U0G5:/hjwHGkBpSIKCUfLmHDJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417431, "uuid": "7cfb9465-1110-4a0b-b012-9cd26afc8eea", "value": 315127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417431, "uuid": "ab2dcebf-5df1-419e-8232-4633452f715e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417431, "uuid": "53ecc7a2-618b-4685-86d1-fbc861bf8888", "value": "72ac15be91b759522fb1e874bb049ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203ec426-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633454252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454252, "uuid": "7e036be7-7125-42c5-967a-ca4ba2d6b164", "comment": "Malware payload (TrickBot)", "value": "d8587852d8002cdea7ae4680a62d2054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454252, "uuid": "bce82042-d459-43ab-a5ea-63dce77c2bf3", "comment": "Malware payload (TrickBot)", "value": "474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454252, "uuid": "749626c5-ad0b-4f7a-8480-c39d4488d08e", "comment": "Malware payload (TrickBot)", "value": "29d8aafb0e356ce51d1e636f454e433f6997df6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454252, "uuid": "f6a06e17-bd9f-4d6e-b17d-f2f0fabc0717", "comment": "Malware payload (TrickBot)", "value": "80e7f1a31c94b018d1f6e5884e9243749b72303ab5c49083dcf9417029199f549adcb90116943a194a2a246f0257a2a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454252, "uuid": "ca1f90e2-4229-47bd-a46d-a8d4a2e7d3cf", "value": "T1B6F4AE0631D0E1BAD5E321B4CED1EB3956F9DD9287290BCB6B81F91E6E326C0453B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454252, "uuid": "c6698578-c055-4b6b-a9c4-69bead64e31c", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454252, "uuid": "f67ee891-e89e-46c4-a083-e10b8a3cc4af", "value": "12288:vJMtObg6CM2wUbyh/pSR/lW96QZk6BSb9XQox4e6oqu:vTbxCM2rc/8sL/Bo9XQ64f/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454252, "uuid": "2c0ddac1-337f-4bcb-8bbe-0443ca7dc3e1", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454252, "uuid": "43a74920-d3f1-49c8-b1ed-b31c716be1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454252, "uuid": "ca5037b6-063f-4294-be15-4b931cefe671", "value": "d8587852d8002cdea7ae4680a62d2054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49290cf7-25ae-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633419102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419102, "uuid": "4b35425b-9fc2-4562-9a66-41847fb9c586", "comment": "Malware payload (RemcosRAT)", "value": "3adf81d1c179df8cf6f3b81bb8c88063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419102, "uuid": "a4a0b26d-b98e-4ad5-8c9e-bc9896e879fd", "comment": "Malware payload (RemcosRAT)", "value": "4860f15c7870ac1d09c5aad7e6754eb34afd4b0f6341fd452049257513951ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419102, "uuid": "36e70035-3259-4ac5-8e5d-bc7a453d1e16", "comment": "Malware payload (RemcosRAT)", "value": "09608001831266a6f377394b24bae15e6897a870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419102, "uuid": "b36fc7d7-ca68-4f48-ad18-3e9a27f891f8", "comment": "Malware payload (RemcosRAT)", "value": "007ea69d0007554ae03482a5edb29f9cfe4cc8d2aab4d6899c54671a564fd853451399a8b0098ec618ebf867e6c67d57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419102, "uuid": "b6a00031-c553-4991-a28b-0b3cddf9b250", "value": "T1FD15E1AC3A53349DED66C1B6DD586CB0A6697C62231BC52340D33D98797CAEADF000F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419102, "uuid": "7f257075-ff5f-4128-b7af-62107a2d9d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419102, "uuid": "1ea42886-c8a6-4dc4-91b5-d07e16899722", "value": "12288:Owa07x3QZMTUJgY4W3jcHd9CfKMGxz7+azQsH68+iDgTdTa4BEMoWLq3wRSSML5M:1a238Jg7vv1Xa8+iDePEMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633419102, "uuid": "fc6166df-4a7b-40bc-a64d-93c27ea2dba9", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633419102, "uuid": "6834326a-95a9-40f9-a5f3-c229eac93bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419102, "uuid": "66a19be3-1c46-4ed4-9fdd-d443a050bd50", "value": "RFQ - QT-2110-300-280302 - (DWG.NO-CV-03) -RI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4338f4-25c1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633427294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427294, "uuid": "865e93bc-3891-4dc3-bb89-7004b513c6d7", "comment": "Malware payload (RedLineStealer)", "value": "049ae3aa2c71389246c85aa2013b6357", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427294, "uuid": "164aaa8f-a711-434a-8f31-1643ad6707ce", "comment": "Malware payload (RedLineStealer)", "value": "491c2f489229addde1ba9222c0109b68f2e92b8d4ddf87cd849fb34bb35e6c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427294, "uuid": "14ddb5c5-6f78-481a-b3bd-e29b2f776219", "comment": "Malware payload (RedLineStealer)", "value": "24d919647c7f6408cda9dec1b118e7e354e0e10e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427294, "uuid": "748aabfb-8e51-4b2b-8076-57832f3a7074", "comment": "Malware payload (RedLineStealer)", "value": "873c0fca30be773c8555799188bb6b17c50cf59cd6b3cc7d4f11e29785123a29c22b3206df65a1c67c1feabafdc3a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427294, "uuid": "cb83e8f9-3cfc-4da6-98a0-7396698e5d50", "value": "T180C33A6553DC8B28EAFE1F75B4B0111147F0D18B5502EB5B9DC2BCFA9E32B426B502E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427294, "uuid": "7262ab88-3699-4141-9269-c417f5deed31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427294, "uuid": "ab690572-17d5-410c-88c1-47e3216cebab", "value": "3072:MyUfrxwjPZwwwwwwwwwwwxwzww4FKvIAYyOd7ckE+Lx:N35eyIIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633427294, "uuid": "91a1eb84-f5de-4533-a84e-c4f254f1fe3e", "value": 119016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633427294, "uuid": "2d394dac-53fd-4656-9219-09b7fd2dac32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427294, "uuid": "7a5bd6a1-00f6-4f30-bd39-66a341a161c6", "value": "049ae3aa2c71389246c85aa2013b6357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0b7b93-25e5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633442833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442833, "uuid": "fe6a99c6-06f0-43c4-bcdf-40db51a76865", "comment": "Malware payload (AgentTesla)", "value": "0518bf639cc856d129f734a20b6ec573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442833, "uuid": "0ca148e3-3c25-4d49-a3e0-b8fcefd04e18", "comment": "Malware payload (AgentTesla)", "value": "4939fd9f7a6efe903622f1eba7bf9b23c2b978e1c2b907bdf0192373151bc511", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442833, "uuid": "21d0dbe7-9dc0-4df4-9f8d-323e38018700", "comment": "Malware payload (AgentTesla)", "value": "14823f11fb177af8d2ffc1f14a259b91f61eb2b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442833, "uuid": "38f3e835-25e5-45d2-a45a-081ee2e40b76", "comment": "Malware payload (AgentTesla)", "value": "fd1dabdbb217f067b493b5f330cb372fbcd8a7ce3b43966ff1854bbf87d6472aed4c38f7fcb1288eacff322c7e3bf097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442833, "uuid": "85fcb18a-8d70-492d-b661-ac035b2ae645", "value": "T10FF4AF97314B8B88CE794FF2221E818063F6ACBBD518D3195FC572E65EE2BB10911B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442833, "uuid": "ff459f4f-5c7e-46c5-bc3a-c354269bc9b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442833, "uuid": "6cebd5f7-1f0c-4988-8869-67b6af52cb62", "value": "12288:AOcocc0WxODTwY7DIlOCpBBdTsenxP1Jmb+cM/U8v6nnjqKoe:Tcrc0WxUTR4lOCpzdTvqaUY6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442833, "uuid": "26f55646-d5b8-4064-a924-cb459a05c619", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442833, "uuid": "05c9b64a-be81-4bbe-86a6-bc1c2ce6f92d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442833, "uuid": "c4565dcf-7a67-4799-9ab6-14c4f4bf2cbf", "value": "0518bf639cc856d129f734a20b6ec573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717b7276-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633437638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437638, "uuid": "c2c4ff10-d72b-405c-97d0-f22a8535d78d", "comment": "Malware payload (Formbook)", "value": "808892ab63c716d478925ecf7637501b", "object_relation": "md5", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437638, "uuid": "af9ea92d-d032-4469-a676-beb7880e2c25", "comment": "Malware payload (Formbook)", "value": "49d4c6854d290ec44c33b93088b94106f8b0687455a64cb133c7e2cb2de2d658", "object_relation": "sha256", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437638, "uuid": "3434a13b-dfb4-403b-bdbe-988183c2f0c4", "comment": "Malware payload (Formbook)", "value": "7a00962270239b3597cdb05843aff2adabafc87f", "object_relation": "sha1", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437638, "uuid": "f4b24c8b-0cd3-4eda-8835-97d5b86b9226", "comment": "Malware payload (Formbook)", "value": "4ce6df72fe03d73c56be3919287cfb8db70d3dee510dacdf09bfa709c23153cadb0d7049f0cc086352f6362eae7c1b47", "object_relation": "sha3-384", "Tag": [ { "name": "ALB", "colour": "#BF1A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437638, "uuid": "6372cd29-456e-4d64-8263-9c31c3f920ba", "value": "T102258C2133DD2BA4FC7DA378D521445007F1BD169729D61B7CD222DE0DB9EC2AB2A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437638, "uuid": "8913430a-098f-4d09-901d-ad9ee8bd4df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437638, "uuid": "c577591e-56e0-4198-bd7b-129371f53825", "value": "12288:Vcx2iNHc1MwJ7D7OYyZUVwaCRxbPcVLJKmZdQL1QkZ1hLo5i:Y1Vcn5OY7sj7cVL8m4X1ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437638, "uuid": "9a7eecc1-eff8-4c9b-9672-f303f5928bf8", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437638, "uuid": "d980d350-1f5a-4c4d-b04e-bedcf0b4d52e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437638, "uuid": "9c519c9d-cd7c-4cb6-962f-8851428fa819", "value": "lista e porosive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562c00b0-25f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633447900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447900, "uuid": "cb3e7953-5d39-44f3-b6d3-98a35875db33", "comment": "Malware payload (AgentTesla)", "value": "17e3351ac9b583cbd6ad8d6092f9d687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447900, "uuid": "fb83f977-d926-499e-943b-1de6f8a0f926", "comment": "Malware payload (AgentTesla)", "value": "4acc7cd61a515fbc9e62b57c7f2428957a2805210dbdffb67d03fcc5ddcf3c38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447900, "uuid": "5d56e48d-337a-4348-842e-cb5c9a41c642", "comment": "Malware payload (AgentTesla)", "value": "5095dc963b96e806fe6978621491a8aabf592053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447900, "uuid": "79f78bde-06f0-481c-8dee-aecb26abf55f", "comment": "Malware payload (AgentTesla)", "value": "089316ce251decc076fe7a0527af1917496e432113cc5d190ea082e9575d0b3811a06b13ba43530b3f19c1fad6a531f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447900, "uuid": "34069a00-9e7d-43bb-be5b-2833f2192836", "value": "T1CF15DF4237E8594BE1BE16F46876561307767AA7BA7AC7CC5D8830CE1AE3740270372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447900, "uuid": "f76fada7-02bf-4b3a-8e3b-245fbcf289fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447900, "uuid": "6ac80eb9-fafa-43b5-bbce-1543e2a4fb71", "value": "24576:24D0G48z0pMAly17CmugeAG3tJochSkq3mclOqvd/jmOqrqi:lD0G48zwMayURbH3tJDhDq1OeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633447900, "uuid": "8d423a39-91f9-4db6-b1bb-cdfad71e8d3e", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633447900, "uuid": "d66d18bb-d936-4e6a-899a-4ca410f42735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447900, "uuid": "e08705fe-ac00-4509-9bd1-64db9a85fd7f", "value": "17e3351ac9b583cbd6ad8d6092f9d687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6891dc-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633437849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437849, "uuid": "e418b930-87c1-4764-a99e-73852117beb7", "comment": "Malware payload (STRRAT)", "value": "6c732bf565d603e8aa7b1112c0b7c1bd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437849, "uuid": "086cd710-ab67-45ca-bfc6-364c7a2689aa", "comment": "Malware payload (STRRAT)", "value": "4bd618950bab39be4448dc1fbe24169c0566fa225becaa91e3a545a760a6c7cf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437849, "uuid": "f1d73ecb-ebd7-4b51-b229-081441a365b3", "comment": "Malware payload (STRRAT)", "value": "f18bd0e743310ed4888d2d01067d74a05eaa1347", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437849, "uuid": "bff9c4f3-51b0-41c5-9eed-6ce4ea1bd43d", "comment": "Malware payload (STRRAT)", "value": "e94b88eac5907d1453ff16bd7b68153d14db0c964e1ee911d6bf54f0a818e03dea19ac9fe04bf267ea2ea2d477f79014", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437849, "uuid": "2607b19d-461b-42fd-9db4-cccca2e728d0", "value": "T1FD04011BBF27C0A6F02F22324559C172A19EA34DE411543F14FE46680DFADA94B83ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437849, "uuid": "355b8f84-3a5a-4faf-8ac1-e05e6dd2983e", "value": "3072:urcuPs/NRGJd9J86/WCGJKakYuFSLwMwnhrb098zax9CVHw5fMBKi7LmQP7OahIy:xu0/Lit8JCGKakYuFSLwthrb5rHw5shZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437849, "uuid": "6c0015c4-6b7b-4198-95ec-8f8d25a642d6", "value": 188556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437849, "uuid": "a8bc9c3c-e52a-45a9-b23e-9fb008714205", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437849, "uuid": "23ea64b8-376d-43fd-b0de-a42580f02c54", "value": "PAYMENT REMITTANCE.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f0d99e-25b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633422690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422690, "uuid": "4e203107-19df-46a1-b35b-99cf95e3651f", "comment": "Malware payload (RaccoonStealer)", "value": "11a47ae71acf5ae3dd5e1b34bf7f8313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422690, "uuid": "6917ffec-ddae-4783-9c2b-cf96f31dd648", "comment": "Malware payload (RaccoonStealer)", "value": "4bf823a252175861293d6cab973a7f1e40216918b253747ed96cbae118054f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422690, "uuid": "4b290fe8-ddf7-4d64-975d-2281fb7b18b7", "comment": "Malware payload (RaccoonStealer)", "value": "9f107382f9979f70b84aaef2855bcbfcb6658a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422690, "uuid": "cd9db8da-2956-4dd9-a56d-51a21c96ce74", "comment": "Malware payload (RaccoonStealer)", "value": "f25ffcfe4f5d3f060962e479b4f2a67318b70ff9e735268dead87d7159689b18a8003893001253380991f023f407f1c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422690, "uuid": "21d3c2bc-fa7f-4cea-bfc8-1ac42791ba4a", "value": "T1CAB4E01073E0C034F2BB15F649B987B8A53DBDB1672891CF57E52AEA06B85E09D31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422690, "uuid": "ea964e1d-b5f1-4cda-b62e-85e83cecac06", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422690, "uuid": "df34c380-101e-485b-b774-a20c95de6665", "value": "12288:T+J+vF7dn3RgaX5ajTxIAkYG+TzKinnwa5fNMJQ5inRuK:GslV3R7jAkYlTjpmW0Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422690, "uuid": "fd7f92ed-d8cf-4e28-bb6d-266b6341ea15", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422690, "uuid": "8dc4ddc3-14e1-44ce-8b25-5681d973a1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422690, "uuid": "548cf544-ea17-4362-a0c0-c018a93c14fa", "value": "11a47ae71acf5ae3dd5e1b34bf7f8313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8a6bbd-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633436982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436982, "uuid": "690e6e6f-4859-473e-8351-2a31f036cdb4", "comment": "Malware payload", "value": "4b8f016e0e5f5dbbe048963a09c8cff1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436982, "uuid": "b6332fc7-83c8-49c2-a538-7c89c69a9b5c", "comment": "Malware payload", "value": "4e0678551ce62f605da6e05b453d5f6af280d90d21f15b1916468161c7006fcd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436982, "uuid": "965eac67-e5e2-4e77-b335-10a1909302f2", "comment": "Malware payload", "value": "b009312f5af7f22d7cadb998c426e0ff703eda37", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436982, "uuid": "b681fbd2-33df-4c8b-9691-b8430f983d4f", "comment": "Malware payload", "value": "99a999f6c7aaca4a2c2f0e49f1370f10a96793ba366bdf66db26c57e9226b3ab0b65d4f7eba1674a940e92921f2ef8f8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436982, "uuid": "33c42687-e3b0-45da-8dd2-47c8c39a62c4", "value": "T15A858D22F2E28437D1732B788D5BA398A939BE112E38444B7BE52D4C5F356813E253D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436982, "uuid": "615b5a2b-aafc-4d1e-ba57-735c6c2fddae", "value": "24576:TeRiEQ3oawTW5AeD6PGaK0awUrx93jgEnmU14HZOf23KsiSBtFTpUGbM5UATU+85:Teo+pK0aNxZhnm73Ksv2TPNOYoEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436982, "uuid": "afb027c8-1aa8-41fc-ab0c-e788719bf412", "value": 1840128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436982, "uuid": "c4aebd3f-725d-4d4f-9f0a-53e246f7ff9b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436982, "uuid": "4fe1979c-6790-4b93-ad16-a04cd0e1b47f", "value": "_-cioetzluspmlshsgsmbeqckhl.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a392ed80-25bf-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633426555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426555, "uuid": "30710b86-4dc5-45fe-9f5c-433de8a9db67", "comment": "Malware payload (RedLineStealer)", "value": "6e051a67febb2b9029d84ff175fb8555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426555, "uuid": "236b5474-8bcf-4bc7-b4f3-0fc25841bbc2", "comment": "Malware payload (RedLineStealer)", "value": "4f1f6c55849d794e71b3f37eb1c700348e31a080eaa14f3586450c0e76b241c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426555, "uuid": "2ddbf7e3-1950-44f6-a99a-dbca5e5a0e22", "comment": "Malware payload (RedLineStealer)", "value": "167ee392f6f5617c1bc0f864f93d19332f8232da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633426555, "uuid": "4cc0c240-5869-412c-b90c-02ed2b4c79df", "comment": "Malware payload (RedLineStealer)", "value": "56895df1bed166e0a59eb60efa1b123089f34f1243aba9d7589a10f67bb9b84551620aeea6cea4f85439133a6de86d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426555, "uuid": "14e1dc42-14c5-496d-b259-223db8fee03d", "value": "T1161633C4D683806DFAE199F30E79224DA6E2F23F111DF943AA057F0636A55520E3C67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426555, "uuid": "de4af619-93b7-482b-abb7-e6fa9e245aaf", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426555, "uuid": "e1afde15-b085-43d7-8570-79b7a9900044", "value": "98304:ylFRFN3k9A1fUp74/bfcfn+mtgHsnq9+W5pP52:yl3FSA1sp7aS2HssFH52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633426555, "uuid": "c39ed04e-7111-445a-a8bf-5afd543ca98c", "value": 4353388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633426555, "uuid": "9083fa0b-75e2-4370-a993-c2cde57f65bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633426555, "uuid": "e2b192f3-4667-4b6c-9b47-b72528ebc7f2", "value": "4F1F6C55849D794E71B3F37EB1C700348E31A080EAA14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a859b1-25ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633453769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453769, "uuid": "da8895bc-b769-4e9a-ac5f-d38207b739e2", "comment": "Malware payload (Quakbot)", "value": "247ddaaadb00934d24bb9d12baf11d6d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453769, "uuid": "b44f8eda-e654-42bb-8275-fa16b9699485", "comment": "Malware payload (Quakbot)", "value": "4fbb9147fe6e3035f87d8b40295a500dec7b12d7577d9f654afa7281c3c60dd6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453769, "uuid": "34d9961e-2f8a-4b70-af3d-ae3aa547be77", "comment": "Malware payload (Quakbot)", "value": "6258ff528ab99834a10a76fd35015b755efafc90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453769, "uuid": "814c37c8-97e3-43a9-a666-c136828f6fad", "comment": "Malware payload (Quakbot)", "value": "71f4c0453ab1259e0091572f683627e321c1e7c40f15e740d2675d0044adc37e4a95d1e27013f8c3604c578de63a4947", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453769, "uuid": "7a7d616c-47a7-4f35-a335-513c0a2dc190", "value": "T1F3350E543A54F510EAA96972CF6AC5FD07057D09EFF1B49B78E03E0F2AAE8A3D511302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453769, "uuid": "65bdd018-86c2-4c04-a26b-91c0f572d7ee", "value": "86f227428cc280e632de33ee19cfd54f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453769, "uuid": "4478d87e-777e-43ae-8dff-c18ce183db37", "value": "24576:Dg69GxisYe8pQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jg:CisYxpg0vxgtqcuABLJ2PiIsROmjbfg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633453769, "uuid": "69ba1b59-fb1b-443c-99c1-466a243a3348", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633453769, "uuid": "b03cff15-8eb9-4350-a6c1-f0eddd37c267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453769, "uuid": "f0b80ef9-9360-4476-ae8e-4bacbaf0a971", "value": "247ddaaadb00934d24bb9d12baf11d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66e5ed5-259c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633411635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411635, "uuid": "37077ca7-ca0c-4e73-8040-a58f8a3520bf", "comment": "Malware payload", "value": "75280b763b5bc1597b847a541094b0a3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411635, "uuid": "78091ea3-a726-484e-aa97-220da70c8de3", "comment": "Malware payload", "value": "501711efbdc0885bdc7beed2a9308d53f4d3f66409f6bcfcac6d2f2e101595d9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411635, "uuid": "649b985d-4b75-4dcd-aad9-ecb1e12e398d", "comment": "Malware payload", "value": "4b852efd272df732fdcefd5c948fb505bf474ba7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411635, "uuid": "f97504ae-a78e-4ed4-acfd-c893cdb2b35b", "comment": "Malware payload", "value": "895462f0e1c703247489fd58aa4c0ba4aa65128c7d7cf49f106653bc7ff4d30b154d7d36c3d940089250116c2ddf6c6e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411635, "uuid": "4add9fb5-9754-4ba8-bc57-1fdf043d16ba", "value": "T1B025DAFC304A49ABF6C8C8089945F2656D61E7B3EFC07B50136EC4789E1D9F69E8814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411635, "uuid": "685fd5c3-d9a2-4f83-94ca-525976627803", "value": "3072:inAbPTn+hlBR8T/CBNbVcgjcytWCYdzFtr5RDAw5wf3:jP7mxp5VuCYdzFt1RDAUwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411635, "uuid": "7f3cb592-eee7-4cb1-9bbc-5d741f05161f", "value": 1042448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411635, "uuid": "6bb9e1c4-57ee-42b0-95d2-e4815c83eb5f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411635, "uuid": "a1ae476f-9360-492d-841e-840fb4e45bc1", "value": "Scan20210410.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605f7d05-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633441045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441045, "uuid": "7e4e95ae-14a6-4f63-82ed-3f0ea5333423", "comment": "Malware payload (AgentTesla)", "value": "3782f6ecd7b6180b3c58a754dad37800", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441045, "uuid": "f5cf007c-77c4-4da0-812a-090aa6201b89", "comment": "Malware payload (AgentTesla)", "value": "51945f52bc1f3387c32c6918e8a45e2d3a2747a9b4a64c95f41f2adf3b39aed7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441045, "uuid": "2adb2095-be20-46a5-9bfa-48db5f884138", "comment": "Malware payload (AgentTesla)", "value": "a71e9ccb6990e024bab2dc28a00259f760170f19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441045, "uuid": "73e546a2-1ac6-49d7-8380-2c9675c9d8c5", "comment": "Malware payload (AgentTesla)", "value": "b4a63a8d330d9117e073542252a442c1cbb268c6e40c052be1f9722420e4379223b5ba390220feae2239e3fcd5231e7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441045, "uuid": "b6180117-ba55-47c2-8b2a-be51ab7cf54a", "value": "T19AE4F13C5A730914FE7887FA2C6890B157F76DA4626AF9BD0DD0BCD438337A4980682D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441045, "uuid": "dc941c76-b830-434f-a535-78164fbd4518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441045, "uuid": "e7dfd43f-56fc-409e-8d1b-00f8b4d5de89", "value": "12288:SIodYW0sbGSFQgbwjc1GPql6xbEZtIMj8cMuvy9NDN8wF2:SI+Y/siSFwjHsUcW3Xkip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441045, "uuid": "2ff34ac1-cbc4-4c3f-9817-4278c6c1d2ee", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441045, "uuid": "19375989-ff6b-4faa-9aa8-51138805616f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441045, "uuid": "f8faaf9c-b45c-4ab7-9ebe-287fc3e82d23", "value": "QuotationOrders00152667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ac2fde-25d4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633435531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435531, "uuid": "5e3a763b-5f7b-4ac8-a0e5-7b4e8d47ee7e", "comment": "Malware payload (RedLineStealer)", "value": "5bec43789401e42ce38a1125f88c7b69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435531, "uuid": "05f63db3-6063-415a-a7af-8aabe9f1e2e1", "comment": "Malware payload (RedLineStealer)", "value": "51d53ea96cef125f782633f97ae3e7bfaa19c50aeed07186ce85f0b09e7f4446", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435531, "uuid": "6a423c5f-7043-4919-89d4-e8b2e9c4a441", "comment": "Malware payload (RedLineStealer)", "value": "01dfa05310b6237d22a4137cd49a71912b6cdd2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435531, "uuid": "db3debf1-1cee-4785-9a13-02f568a07cd6", "comment": "Malware payload (RedLineStealer)", "value": "cef734f3d15fde2bb571e29754cdca8e250fd49e912d6f2c7e72ff1a8b13b03daddc79881e7adf302683536bba5968cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435531, "uuid": "dcad546c-440a-4c4e-801b-264e53d35efb", "value": "T1F274BF10B7F0C034F6F722B549B593B9A53A7EB16B3486CB63D01AEA56646E0DC31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435531, "uuid": "92bce6da-20d1-4483-8952-564cd09b4991", "value": "077da89a12148c6ee034067c75e2bb0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435531, "uuid": "d5696783-10fb-4398-bbf6-6866d976be8d", "value": "6144:n6gO5PkQbQcsTbeShgVzHSPoPvn9kdgItv160TGKX5e:n6gO5PkQbCbUV+PYvn9qjjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633435531, "uuid": "e42bcf23-04d2-46e3-a325-472ff22385c9", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633435531, "uuid": "4dcd80f7-3469-47d8-850e-c57521c05343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435531, "uuid": "0d707c3d-0be6-43f0-a2c3-86ebf0a15871", "value": "5bec43789401e42ce38a1125f88c7b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfcae4c-25a1-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633413498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413498, "uuid": "964eb42f-9d25-4331-91ef-26f3bba4a711", "comment": "Malware payload (RemcosRAT)", "value": "caabf7452a6be9ff39d444f4e46a231d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413498, "uuid": "b016787a-6253-4cdf-b3df-b23f21730aa2", "comment": "Malware payload (RemcosRAT)", "value": "525871f7cd7f35fd4d614d5418475a07d042f79de0c24f49a72a51e7273f76a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413498, "uuid": "e8a9c907-5369-467f-92ea-6fb4b8a96c81", "comment": "Malware payload (RemcosRAT)", "value": "798aaf0d6cda2c3c57bcec68b5cd1e7645fee61a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413498, "uuid": "5ae0a91b-85e0-4990-a808-63e160d35856", "comment": "Malware payload (RemcosRAT)", "value": "bb7eca4db3e21fdee304fda791fe3665193acdecc36e065784702ea955d60b199c18943f6be159cd4241917209c45bd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413498, "uuid": "ad6070ba-5a41-4d15-8ee9-9bbb64962f6c", "value": "T13EF45CE1A2D556F2E0332A7DAC5AB29034197D913EE8DC4D26D9CD4B0A31ED03CE917B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413498, "uuid": "30aa3f44-84f6-4973-873b-45b4d483d085", "value": "48363177332cef840c51cef50a86516c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413498, "uuid": "89b6ed4f-dfcd-4eb4-ae87-5e1604045dad", "value": "12288:0X8lG7bLQlI+h4Y+RNEVpgnoWO2ucgD6g8LxoKnKVHcNs:0s+LQbh0KUoWO2uh2KVH0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413498, "uuid": "b44da270-6f41-469b-ae14-c752bc94aec7", "value": 736184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413498, "uuid": "301b437c-acc9-4bd3-82ff-dd27dfa9eef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413498, "uuid": "3761f45d-6fa9-4c3b-a779-f70388879c2b", "value": "Bestellen 20649.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9d9417-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633411669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411669, "uuid": "2fe6e150-6abf-4174-9716-97ea3b222a62", "comment": "Malware payload (GuLoader)", "value": "6697830aaa634e3385444958ade1078c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411669, "uuid": "5c29db7b-5ba5-4bb4-a925-57ae43023c5b", "comment": "Malware payload (GuLoader)", "value": "53cf55e7c574e892ef150f8ff795f9880b0fcb974a12e17101eb387ebe0314e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411669, "uuid": "9104aaaa-a8d0-4de6-8816-640c0b45532b", "comment": "Malware payload (GuLoader)", "value": "13fca1947facfdfb71d3dd546dbdf7b2c463b70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411669, "uuid": "c7ca8c57-b1c7-4ebe-b100-a132309a1e0e", "comment": "Malware payload (GuLoader)", "value": "88f00db6b8457dc6ca5091cb36e50752167f55a2a134cf304e9077c02077703c03eca13bc856375d43ed2d074f77c9a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411669, "uuid": "c0ba6354-f375-4f99-bc1c-5c525ff1b103", "value": "T103C38E13F6424838F59ADDB1315B62E127CEAD25E5408F1F20C4FAAC69B04DF69AC74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411669, "uuid": "9095b166-6f7b-4163-876b-07eaa268a738", "value": "a661671ef02a6d0e6a34eab52e2e0015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411669, "uuid": "2b76f055-7d40-40d4-b69f-72443e983bb3", "value": "1536:iJU7QPcCLohQJ3kbRjqyeNX6ijy9xvO9XyIOk/d65IMG127:77GJLrJ3kb1yF6ij+xW9XyO65IVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411669, "uuid": "1ad71de8-ec94-4315-9ddb-03cdc2d17478", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411669, "uuid": "be9fd2c9-91e3-4da6-bb42-32f2aacf1336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411669, "uuid": "71661be2-fb0b-431f-8c12-1ed5c3b61f41", "value": "bank statement 001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbe1451-25a3-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633414544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414544, "uuid": "a979c4af-25bb-4ec5-baa7-b13dac170f87", "comment": "Malware payload (Metamorfo)", "value": "df399ac11387d4805515e7dd933005ad", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414544, "uuid": "8d44e1d4-0051-4a43-acf8-8349e33662aa", "comment": "Malware payload (Metamorfo)", "value": "54acc2a76c5a4ed21ca0166ff1b2d165b21020190e4081d35e2493e03eb0d5a5", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414544, "uuid": "9582a03f-6566-43ba-9088-f8c9bec8b0f9", "comment": "Malware payload (Metamorfo)", "value": "79a3d5bddc74285fe868fef50dc4bf375fd46f56", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414544, "uuid": "f18fd02e-d2c9-492e-845a-93dc429a5b18", "comment": "Malware payload (Metamorfo)", "value": "0516fc70cde664f0028f155a102a9ffcf4ef9deabeb97cfd191bd7f316165566c76b45a47ce5a6a108533fd694732750", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414544, "uuid": "531533cc-9bc5-4cb5-b793-3e9158c81123", "value": "T1D331CE051ADA1329C3B38E7A1077A2464A76BC41AE934F9D808097CA2861050FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414544, "uuid": "689803d7-a0f5-4046-8569-c6546263093c", "value": "24:8+JUHRlVo5kcbA+PplYL+/P+POeh41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+hlYUce1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414544, "uuid": "9af30511-4d3b-4e01-9433-4c267d1aa9c2", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414544, "uuid": "6c76e0de-73a1-4815-99a5-5441c36484d2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414544, "uuid": "528d9492-18a6-413b-8260-88ed1818895b", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adac631-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633424339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424339, "uuid": "9c19358e-81bb-4648-8282-acc069b49164", "comment": "Malware payload (Gozi)", "value": "cf24411fb8167a9e217ba80c2eb29aea", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424339, "uuid": "5a60f833-029e-4f26-9437-76e4937b2252", "comment": "Malware payload (Gozi)", "value": "5573f897e63b4acc883fabb0974b495278d84aa3edba1c335c0bd8e8a5c639d1", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424339, "uuid": "342bd188-3fc3-4dbb-9118-7eb0e210bbc6", "comment": "Malware payload (Gozi)", "value": "0ce703e17e9ad29fb5eb398cd564acc79f0ce08c", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424339, "uuid": "8b39f91b-d024-4ab4-b22c-598fc692ae22", "comment": "Malware payload (Gozi)", "value": "d18664ca7500a7164e62262457726ffe4d81165aeeb08c20459bbfa4bcb96d77fa39f28a95a5d511723244510f204c05", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424339, "uuid": "8dd78e94-e919-4263-95bf-12feda27ada7", "value": "T1F633D615B756D98AEA5213364CE2C6EA7332FC51AF6B47073244B31E2EB92D1C90370B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424339, "uuid": "f4461b00-0b98-460e-9d75-78d86a7c4441", "value": "1536:ZsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0wBPF6P3Gmsi+I:ZhlYkEIuPm3fNRZmbaoFhZhR0cixIHmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424339, "uuid": "9ddb202e-f89b-4f04-99b1-f93d3e3ebad9", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424339, "uuid": "eb74cdbf-f18e-469c-b0eb-6637fe871676", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424339, "uuid": "27a418c4-3d16-4668-a0e4-036548feb25a", "value": "DDT_2021_0000245.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae08f73-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633416877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416877, "uuid": "cf26000f-e774-4c48-889c-ac529eefb7d6", "comment": "Malware payload (Formbook)", "value": "1eb534dfa10d009af7466b0193a26342", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416877, "uuid": "7c6b4c16-8115-46bb-95fa-063c390c4778", "comment": "Malware payload (Formbook)", "value": "55e1b6c2c6d71d55ad9567bfb670c00afcdb1f9363e315f8e65444c699e33a96", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416877, "uuid": "e39740e3-218e-47ef-889a-b3e7336c99dd", "comment": "Malware payload (Formbook)", "value": "29d1c8317337c788522b5d34a37d10080276d5d7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416877, "uuid": "93265348-9f92-440d-ba9f-bb070a8180c9", "comment": "Malware payload (Formbook)", "value": "bab43c322d0e7358bb23142c2401dccd3810380b935831c8feda866a58d5f536cf1cebb4dec7c3275412a5f577ddafbc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416877, "uuid": "fe0795b5-7253-4ec4-bf23-a20764917031", "value": "T1977412007F959FA7DFC9ECF6120B01A70468ED15A34D7709AEC63A6677306C632B521E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416877, "uuid": "6159a2c3-0c25-40eb-8488-7c3884f1e416", "value": "6144:X/o2O13SvVmSngk5pJZ+bhpLFLRJDVIMIYc58nDpJECGcXPtuKdAC4:PFM30mSngkPj+b1VRhM8DpJHGGqC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416877, "uuid": "f823942d-683d-4bea-a1f7-40ac50c75f1d", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416877, "uuid": "b95e7f72-79e3-4e72-89f8-bf786ffb3cd7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416877, "uuid": "fb74e973-58fe-4979-b889-9e9547488374", "value": "SCAN8570.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ae94fa-260c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633459626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459626, "uuid": "7610420c-0040-40e6-90bf-674e80c2f2c7", "comment": "Malware payload (NanoCore)", "value": "1085230a800b6088b5a6d8283e870c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459626, "uuid": "48b4b42c-5f8d-43ac-a044-c9c39e4daaa2", "comment": "Malware payload (NanoCore)", "value": "55f42292f0d6123865403057d672ea236eaf8c306f5654772a0e3c3eb3b3d198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459626, "uuid": "4b82e0e5-0f67-48ba-a0b2-6823decf72a2", "comment": "Malware payload (NanoCore)", "value": "768891985214c7a6a23e692ad565643acdace0f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459626, "uuid": "42612a55-7983-4c40-ae97-9d8ad8dcd299", "comment": "Malware payload (NanoCore)", "value": "70b35c66724988006bce01a489abfcf136b05da3e4e99003a2c42ed6e3545edb55a34f9ccab493f2641eb02625562cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459626, "uuid": "a1f821a6-0d5a-4967-a545-d2544e3b3c22", "value": "T1ACB3062176898B52F23CA775AAF3454003F2B607AB3BD24F7C9805FE8762B45C751A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459626, "uuid": "e6b991f2-d745-4982-bb52-576ff8ddcfac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459626, "uuid": "5dd942de-5160-4beb-ab21-ffb033808203", "value": "1536:4u5JDeCDccWzVUF8l0Idx1BEgCRDiX9K9bnSERjI5g5pikHyl3tpaWQsxmo:XGC0zVNllxDBCRDiYz64Hs9paWNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459626, "uuid": "2982e986-6e8e-4d55-ba7b-3658d50804dc", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459626, "uuid": "5a5e8dc2-af52-4f41-9e3c-a950b22358f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459626, "uuid": "c41a20f1-872b-4c48-a26d-cac367cf2a62", "value": "1085230a800b6088b5a6d8283e870c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39140261-260a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633458589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458589, "uuid": "9957ac3a-1603-4b50-93ff-0dd87002d0f3", "comment": "Malware payload", "value": "716d61c29bce42b09610f7d075c8fcda", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458589, "uuid": "a7fc79ea-cd40-42b1-9c2b-73dad3cef3a7", "comment": "Malware payload", "value": "57db3ac25a078af4897c0e0074529675c5deae55088709e692c2f1e6beb54cf7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458589, "uuid": "46b07c74-d7cf-448b-994b-a72224189831", "comment": "Malware payload", "value": "b93b2fac6d5071b5f16ca4c5edcfa7ab6d4cb239", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458589, "uuid": "ba9b676f-440a-4bf8-8a3b-956b77e91f90", "comment": "Malware payload", "value": "c6640915aa5b25cb65e7a4306f9ff6dd04ec9e20033d8a62688ca2e975c41f361b94d7b6326c260af1d02e8f829b7a4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458589, "uuid": "4a62943d-cdc0-48be-925f-8d2daeb6e1b9", "value": "T1B8242209C1213E90CDCC957DAD1A1CF4A2158D1A2E2294CE422DB749FBE7DF0D98F5EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458589, "uuid": "166e1262-b784-49df-8bb7-08cb0bbbeba9", "value": "b79a86dfbbbe6d8e177dfb7ae70d4922", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458589, "uuid": "417fde33-de2f-4821-8402-103cd8f5796c", "value": "6144:/TPLOrTxZprQFLlCHcy3u/cEcZxKcRIZhjHtJaDe8Y:Ds5QlMtZ2NJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633458589, "uuid": "ed4d339f-2793-41f0-bd0b-e0ff266a879b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633458589, "uuid": "54becaea-ee7a-4758-bef4-270af65eb2c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458589, "uuid": "9bf7557e-7fc6-4e25-adb3-5b7fd6e1fbd2", "value": "tb_unpacked_21_10_5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea246460-2610-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633461463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461463, "uuid": "d960d029-900c-4e22-8fa6-f57f3ced1ad9", "comment": "Malware payload (RaccoonStealer)", "value": "f81e87f9aaa0ec4ff2d89bd67cac574c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461463, "uuid": "e24936e7-3a00-4742-b4a1-8154f2af1391", "comment": "Malware payload (RaccoonStealer)", "value": "58012e1bc38619a3a83b1b3742b066a7bc1ad2bceb622ed5603d7a0175489e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461463, "uuid": "75b3ead2-a65f-467b-872a-c9ad9b1962bd", "comment": "Malware payload (RaccoonStealer)", "value": "0252d407a07912817677c800efa20467bca4fe60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461463, "uuid": "ef18f469-79cd-4f39-8336-49ca91d55034", "comment": "Malware payload (RaccoonStealer)", "value": "12b83f883f8e59b2b05d863bbebe884df6627f644bf82efe76e281e81856faa2bf0da52556024ffd534a18142b63ce82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461463, "uuid": "b5d62fcf-61c3-4a07-b94b-cc2e0571ae08", "value": "T147C4D13067A0C035F5BB16F885F6927DB9297EA157B890CF52D01AEB46386F4AC31783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461463, "uuid": "46135f06-bb1f-422a-a295-bff8b42b086b", "value": "9b1a8118ad0b5e9a72536548770ec8ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461463, "uuid": "5a6751b0-b8f4-461b-8aed-179b677ab13c", "value": "12288:K1PGJBtFlNjgYnvUrXrVqcL+LRK/LLymR9FvEDGGXk:EPQtfAEz0FvYGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633461463, "uuid": "51b21914-77a9-4d67-9e54-64628b7bcfe8", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633461463, "uuid": "dec9e70a-ca78-45a0-acf1-9b4e1516809e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461463, "uuid": "3907bfbf-f666-4387-9667-66b7be315735", "value": "f81e87f9aaa0ec4ff2d89bd67cac574c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65355cca-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633454368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454368, "uuid": "c2b3c8d9-4878-41d6-b669-7b43033d77ce", "comment": "Malware payload (Formbook)", "value": "16bd3a8146065eeebb8550d754624543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454368, "uuid": "af899b5e-2f61-4de4-861f-5911e2a5ae0e", "comment": "Malware payload (Formbook)", "value": "591f1f8b00c0eb6b24da2646904aabaf9ee6e6dcc735cf533bb4c1ccdf9e1f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454368, "uuid": "76b22c5d-e008-4307-bd68-4f15dc0c880d", "comment": "Malware payload (Formbook)", "value": "069192be97a40af2ba5d6ecce4c52e40686e161d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454368, "uuid": "789406d1-68e6-4b55-817b-ddb68f4aff6f", "comment": "Malware payload (Formbook)", "value": "8d4e1c0fd9007be3feb864efc5e47fd24de13715e9b6bafa7da4be9ac3f9290f2f22be4e7a6203b042827e955aa28a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454368, "uuid": "20c4866c-bbd4-4903-a8b9-c9561d28880f", "value": "T114A4CF9433AF6F45ED349FF5141C91D157BABC3B2469D3290ED6B0EA2D32BB00A90A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454368, "uuid": "73e6fa35-39c5-40f4-b113-09134f814c14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454368, "uuid": "452571e1-2534-46b5-b07e-56906b733ff2", "value": "12288:rSocc0W8P9dBhvSKrrWo17qBja570Jza:rSrc0W4dLrH7q+0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454368, "uuid": "1074e1f5-9027-4d71-97f5-6823b5e52d58", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454368, "uuid": "d2d78335-5d01-4d31-b792-6abac9ac0651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454368, "uuid": "cd400530-ef9f-4c47-928d-943e7e24b378", "value": "16bd3a8146065eeebb8550d754624543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab4afce-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633411427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411427, "uuid": "285c1562-6cdf-4505-b578-114a670401ec", "comment": "Malware payload (Formbook)", "value": "c0841eb490c44b6671dd2894db8b99dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411427, "uuid": "4ab67012-8915-49a4-abcf-65cdbf99b92b", "comment": "Malware payload (Formbook)", "value": "5a9028f5ff15aa70efb3347d938c49c79469fc39aacec6e55c4ba0056297785e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411427, "uuid": "785b159c-3143-47cf-9c8a-522372862c61", "comment": "Malware payload (Formbook)", "value": "b42777670ae8900d880d3001b04559af9d3fcad7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411427, "uuid": "201ae683-915a-4e3b-a192-176c0dcde97f", "comment": "Malware payload (Formbook)", "value": "773d6a8f3822b0d8a7d739591dcba93419f13b88b74e94c0bb1064a9b3b7859ff930f79ff5bb1053eca3a3f2b14426b2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411427, "uuid": "1e49769a-049b-4483-a35d-f26190175738", "value": "T16D642220F9B46563D99BCE379F82A04998DF8DB923037BC91356F13A427C3BE9814D25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411427, "uuid": "e62c0a37-170e-443c-b469-ca907a51deb5", "value": "6144:pgA+a33nUVplqb8IzCAA2MuLWUjkb3uoOmVhOKtn/LFiK+KtpiKByx74U:pghCkBknCPuLpceJmVwKFzxisU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411427, "uuid": "5431c1de-e5fa-4760-ae63-f4f565cccbff", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411427, "uuid": "9862bc64-b019-4b49-ba0a-a8f0780250a9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411427, "uuid": "6c941c50-cfd9-4578-a0d4-797a28a2da5f", "value": "TT remittance.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d561c4f-259e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633412130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412130, "uuid": "161dab17-e21f-470a-97fb-44ed7237d0ed", "comment": "Malware payload", "value": "83f26e546cd9fe8403a4402d62a819ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412130, "uuid": "ca50a327-c35e-4fe4-81c2-0bc788d4d9ac", "comment": "Malware payload", "value": "5ab96016ff382c8698b9fae0608545131fa9a1f69f2b78db6737d74f4ff9b420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412130, "uuid": "00647e34-d3b6-49ab-a3dd-72c99854324e", "comment": "Malware payload", "value": "1961f7690e0676ccd08a051a5a18cf9faa4b64fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412130, "uuid": "e0228d38-6978-4b85-8c81-f9ba27d848ab", "comment": "Malware payload", "value": "df288f8c35444a445a438e587df2a5330a7f15bedf27da55e836b316cb88ecc91a6e122d61ca8878681498ebed21383e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412130, "uuid": "5139d8b0-bb6f-473f-9dd6-b0f32e0baf07", "value": "T1C6B41219A35BB67AE51BD8B0E1D77A9C93B352C3FB18A5628F8E48F418136CF034845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412130, "uuid": "05114052-ed33-47d6-940b-53e6343840bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412130, "uuid": "0123eaa6-86ba-4700-a6f2-3a7877297012", "value": "12288:5DgUOPOh9FloV+R1R3IvHkaYm0I4uV3Bukz2pK89:5Dqklm0jYM64uOpd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412130, "uuid": "9cea787f-9560-40ff-a303-c7691ca9b036", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412130, "uuid": "0f03797b-be66-4590-bf63-80b0c50eb55d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412130, "uuid": "75e08e53-f2e8-4c6a-817c-58739202c21b", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d1bd40-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633412147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412147, "uuid": "624b71a5-b32e-4417-9172-b0848b374ceb", "comment": "Malware payload (AgentTesla)", "value": "80b1d0eddcc42f5ca607e88eb0e66644", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412147, "uuid": "1c92ea79-b643-4ca4-b315-afd2282bc59e", "comment": "Malware payload (AgentTesla)", "value": "5bd464e43987811885cda010fa98196e5817dc514fcc9febaa1187f66e84309a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412147, "uuid": "8bbd9df7-3589-4ae0-a910-caf8cf007881", "comment": "Malware payload (AgentTesla)", "value": "c52bfbf1493195aced9507c73b767c6190c3a747", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412147, "uuid": "7c65f639-f6e3-4f47-9cbb-931e79cdb193", "comment": "Malware payload (AgentTesla)", "value": "dcee9be90726798316769d4df33a9b14113e1a9aab016381ea756ddfdbfbacd4e213a79fcc379c9cbb67970853f26b84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412147, "uuid": "4e74241d-daca-43cc-bce4-4dcfbe7828f8", "value": "T192D4B4D453CB99C4B57B2138B0222CEBB47D630DF3AECF1151977A938CBA790561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412147, "uuid": "2f7a6814-c805-4432-a866-f44b108aa619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412147, "uuid": "d1145b61-5c33-4da2-a018-73f1cdf32337", "value": "12288:hIstjsya046Mnq0UnsO5lJkKzUvoPUu9YuVKAWDtmYNoDO3tYr:hFBJV4tmiDYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412147, "uuid": "3da0b784-a62a-431f-afaa-a61e54e39841", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412147, "uuid": "bedfb676-6585-4ce0-ae71-991051116f33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412147, "uuid": "684fc6c3-3297-4d67-bbec-d040df6281f0", "value": "Kredi Kart\u0131 Hesap \u00d6zeti - 4508xxxxxxxx0017.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0571547-25dc-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633439059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439059, "uuid": "05fdfb43-8b8a-4541-acb5-72226f82ba22", "comment": "Malware payload (Gozi)", "value": "f6bf151e287913ea7207000dfe7c9d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439059, "uuid": "83aafd82-eb10-4a14-bd5f-8c49b9d11a9e", "comment": "Malware payload (Gozi)", "value": "5c4a3f53fcc82b3fd5661748c66568c93c3a3db16d6b00265dd7d6add9c0bee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439059, "uuid": "8a3e5166-1a69-4944-a66e-db9a4b310aa9", "comment": "Malware payload (Gozi)", "value": "e8202fcf205a6a3bfc60a969f5a629707631dec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439059, "uuid": "97139b16-f3c0-4171-a820-c82eb58456ac", "comment": "Malware payload (Gozi)", "value": "bd9044621c0ffd88bbb5e348f15836260989cfe9aa9bdc02cee8ca5dd4bb9629f436ea4f0fb10cd32f4dc7379e9720a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439059, "uuid": "5b165068-dafe-4958-ac13-1e40e660b396", "value": "T185245B6AA3E40595ED6BC6B9CE63D61BE7F274092714D70F0370CAA66F17722B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439059, "uuid": "c2c23d57-6733-4aff-83a8-ca38f8919921", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Lu4y5KH:cxb5wvtKRvSxY0G+D7u4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439059, "uuid": "706452ea-ae5e-49d2-b3b5-71deb7871827", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439059, "uuid": "869af396-5118-4e68-b943-8c62e0434f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439059, "uuid": "38ca6891-199b-423d-ae1d-08b9dd8933c9", "value": "b840000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4681454e-25d3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633434989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434989, "uuid": "3698d1eb-10a8-4c7c-ba82-1d7ac9407db2", "comment": "Malware payload (ArkeiStealer)", "value": "24c94818282f9fc1a29b2f00b6b018a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434989, "uuid": "303f710d-0996-448d-a8b7-44e98f3ca37b", "comment": "Malware payload (ArkeiStealer)", "value": "5cf788e38508a9f9dbce08142591763ff947fc590ae2fe162a5f2f1849b2c695", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434989, "uuid": "27b25b42-a850-451b-bf24-601640bd51b6", "comment": "Malware payload (ArkeiStealer)", "value": "a45c8799654d04cbb514aa10d02fc55c900290d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434989, "uuid": "b03e40b9-2717-4154-9cd0-5c7007f073a7", "comment": "Malware payload (ArkeiStealer)", "value": "ad77a667cacfc622483eec0f46ba0a8979892a6ecd6302661b7546fb4f5ec2ddbbc7f726b80c7744371393a2fbd9c1b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434989, "uuid": "6e2b74e4-363c-4830-bd5c-964a6bf962fd", "value": "T10FE40114B7A0C035F1B725F649B583B4A62E7E71AB3493CF52E52AEA06746E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434989, "uuid": "589988c2-74ec-4487-b83d-0146b2e94a4f", "value": "bec5279be0cb3c653f5b0b143b00a99c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434989, "uuid": "ebe0a92b-e019-4fd3-8d63-de9f12adf45b", "value": "12288:VpxYZV0CYer9MgqLUFRW75tM72yxAesui+G1U32GI6niDg1QpwUd:N3CYGILUFRW7oSyxdsuPGLrEie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633434989, "uuid": "a6b090c3-162b-429b-8617-6fa1aeb1fe4b", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633434989, "uuid": "e7603ba9-5aa2-4e39-981c-d750e1b9cd1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434989, "uuid": "d9613350-5559-4d32-af0d-98ac668223b6", "value": "24c94818282f9fc1a29b2f00b6b018a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77016dcb-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633454398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454398, "uuid": "befbd81a-df5d-40ac-bcd6-95970646f444", "comment": "Malware payload (TrickBot)", "value": "81e713ad070459e013fa94d1ca56c035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454398, "uuid": "5e2c03eb-e6d3-4923-a90d-c814c1dc103b", "comment": "Malware payload (TrickBot)", "value": "5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454398, "uuid": "b8fa0511-e6b7-44f2-be3e-149177db99fb", "comment": "Malware payload (TrickBot)", "value": "315ee77a118478f707092d3eeb29fb320849d2b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454398, "uuid": "83c65896-ddf8-446e-abff-6240543c95b8", "comment": "Malware payload (TrickBot)", "value": "847db2f8af1d999f9324d86eaec54fb23d1dd06ae90ac527d457ae92cb11ce1e23fe9c76a7a59b4901bc18c58ffc4a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454398, "uuid": "0fce65d5-4c97-4055-a3a7-1fa5a1df88d0", "value": "T106F4AE0631D0E1BAD5E321B4CED1EB3956F9DD9287290BCB6B81F91E6E326C0453B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454398, "uuid": "832440ab-8dde-43cb-967c-81af18da93d1", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454398, "uuid": "a36f6757-7208-4320-ad09-5f45a9e16021", "value": "12288:vJMtObg6CM2wUbyh/pSRJlW96QZk6BSb9XQox4e6oqu:vTbxCM2rc/asL/Bo9XQ64f/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454398, "uuid": "bd359d9e-5117-474a-b22d-a54918678edb", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454398, "uuid": "6e889042-8fc8-4c5b-9a74-5af9aa1bdee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454398, "uuid": "892fc596-8ee7-443d-90b9-9b3468626d9a", "value": "81e713ad070459e013fa94d1ca56c035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d692750-261c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633466273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466273, "uuid": "c2132cc9-b072-47da-aebc-47732b924832", "comment": "Malware payload", "value": "2025cc89204d851a57c02a9fd441b619", "object_relation": "md5", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466273, "uuid": "ac0404d4-d9fb-440b-9cb3-582b271b3312", "comment": "Malware payload", "value": "5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a", "object_relation": "sha256", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466273, "uuid": "7bb9ee04-3d60-4331-a282-d67cd75ae363", "comment": "Malware payload", "value": "7f501aeb51ce3232a979ccf0e11278346f746d1f", "object_relation": "sha1", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466273, "uuid": "90d50e8e-c11a-4f5d-88aa-c33ac9b84c33", "comment": "Malware payload", "value": "55d050f164d978572de44d0a3d8440cb333a30cef79f40fe1d89b0dfdddae28320f011874431aae6f9099445b0af757a", "object_relation": "sha3-384", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466273, "uuid": "3aa5b28d-59e3-4e93-878e-ad6e5a66323c", "value": "T16DF2D0C50D01AE7ADFD90271D4E7AA229026D1F0CE5987213A9D47AA1DB33E33CE41EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466273, "uuid": "cf158362-fcb6-4456-a229-b273797a24c7", "value": "f6899eb0c1456c845aee20b591c73298", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466273, "uuid": "4899075e-98dd-4fe3-b5a0-9af542b8e07f", "value": "768:p6bG9YETo/grz+5F3FfEYUSdl0bwtY9YLkjW2xQ1MwhFbGdtFm:kbG9YezkMv0W5mwjWuQ1xFbyPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633466273, "uuid": "3d850fe3-dd5e-41f1-8e4b-6ca37253606c", "value": 37044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633466273, "uuid": "a8421ca6-a6be-4d72-b3d0-c5b43a09d395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466273, "uuid": "9f98f9af-bab9-4d21-972f-e7140d8da039", "value": "5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aef594-260c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633459621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459621, "uuid": "d153f795-9acf-4397-9a23-6f1307dcdd31", "comment": "Malware payload (RedLineStealer)", "value": "542411f6939bb36f91d66369abb3737a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459621, "uuid": "994317ac-81e7-4085-8902-76597047fddb", "comment": "Malware payload (RedLineStealer)", "value": "5f1502006bd6b0a7b71d7dde2c26d824c0b125526baa99cdf947d358ca0e2211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459621, "uuid": "60f74c27-4878-4f0e-aaa8-48add936fc32", "comment": "Malware payload (RedLineStealer)", "value": "cb8e15b71e14b60bfda70374a1bb069b5c250280", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459621, "uuid": "69ac7693-dbe0-4514-991a-682d6eda2bf0", "comment": "Malware payload (RedLineStealer)", "value": "bac8b809077bb281b98b5cb40dcf6016f25585db002fb3a4883334c56fefcfe1c547ab8ba378ebf4e2d9f38b666d658e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459621, "uuid": "d5f6cd77-5727-49c5-b41a-c3e731e748b6", "value": "T1C1043E3EF21FF412E1D4F838E0E5A2150AAB5D8E3C8C65753898E911E5B9E487A03F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459621, "uuid": "c6d1c3bc-ca39-42ec-8f47-0c2e794f0b5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459621, "uuid": "603b872b-0bd5-4052-b28a-d6090a8fece1", "value": "768:r3gbFRsoZvMH1fXXXXXXXX3A8sz1gK/aRrO2DXLIvmm:MbF7KXXXXXXXX3A8sJd/QdbIvmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459621, "uuid": "a78cdd61-afa0-4770-9f87-e2ad3f3b2df0", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459621, "uuid": "b6e6bb7d-80fd-4388-8257-7b3135bcda81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459621, "uuid": "6263af40-23e8-4f88-8002-730bf1bd4b23", "value": "542411f6939bb36f91d66369abb3737a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e849eaf0-2610-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633461460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461460, "uuid": "47c9e94f-6ba5-4894-96f2-cf6c3e638f43", "comment": "Malware payload (RaccoonStealer)", "value": "b1c7d017934737676a76955a882a8439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461460, "uuid": "0352a43b-8a57-495b-9b5e-79648e4f895f", "comment": "Malware payload (RaccoonStealer)", "value": "5fa97c6cad2e9d186b19a995ebf1fd9dc481dfaeb8e7fbd25482df66d0661f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461460, "uuid": "022e72df-b8dc-472a-9b51-68778e91c971", "comment": "Malware payload (RaccoonStealer)", "value": "5ea3b7cf3a5b1e9d14feec9ecfba9ed5354f2138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461460, "uuid": "b0ae09d7-3d77-4250-b0ab-e5f1cc9fcf52", "comment": "Malware payload (RaccoonStealer)", "value": "fdb59128919d43ec8a4661d9f616a58517ada6bebb21a5caea921892550e9b5c9392b1067a7479e47603d534953296ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461460, "uuid": "763427ed-7cd7-4e0f-a173-3a9f74011c4a", "value": "T136348D0077E0C035F4F712FA44BE93B4A5297DB1AB6491CF52C52AEA9A346E4ED30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461460, "uuid": "d4ffc735-28eb-4a8a-b48b-648147e28565", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461460, "uuid": "24267a65-aef5-4d0c-b125-0219f4c67f3a", "value": "3072:YodYaWsCHWk66/3uDjG6BRejzQpOrZE4PmWED80jxpCy5ccWXmJJKaNOmCEMojfQ:Yov4d6xCzQkrlPmDTRomJJDNOExiMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633461460, "uuid": "bc87cb99-9da9-4e6e-aea4-529d39de6038", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633461460, "uuid": "4c933698-7730-41ae-b6ed-a60ba56db714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461460, "uuid": "80d0e43d-4064-4bac-ae97-26dd26f03e5a", "value": "b1c7d017934737676a76955a882a8439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cead80-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1633411869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411869, "uuid": "c15e05fe-a040-4baa-8bd0-82f8cd65e9e1", "comment": "Malware payload (AZORult)", "value": "68c2be38e5bedebceb5108b798bb760c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411869, "uuid": "79c4ae68-a0fa-48a0-a41b-bf95399a18f0", "comment": "Malware payload (AZORult)", "value": "60bf55c622f01b6d0796fe3415226d66f8650a9ec5c5aff515777f9c3ac107eb", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411869, "uuid": "38cea8b5-4b90-471b-a0b0-5f39a5295c40", "comment": "Malware payload (AZORult)", "value": "d60414646d66c39820bad63ed69739a0521f807f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411869, "uuid": "c1f2e4d1-7723-4f90-8ee8-febd0bc9921e", "comment": "Malware payload (AZORult)", "value": "a5e71e68323b5ed42571871bec2547d3655a5f02e7060d3804bcf0eac24cde804d0731cded11fe7470ffcdb165f17f01", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411869, "uuid": "1e659bdd-f768-4e0a-a7e8-7c5b45f622dd", "value": "T11F0593943386B5CDF537D239F4101CEAF5B8311EE31BCA0260672ADA8D6D642EB2D5D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411869, "uuid": "9361f629-b442-4d25-a4c4-c9a898f7e05b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411869, "uuid": "7be10d07-5d91-4b83-81fc-551fe1eb3b73", "value": "12288:W4Ojv8TCm199tNZqx046Mnq0UnsO5lJkKzUvoPUu9YfakvojxxkGLbLihmxPL6IK:nOjvFmfku3mmx+IQVuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411869, "uuid": "cf8efa7d-092b-404a-9f94-513d1c1977bc", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411869, "uuid": "13bbb9f6-b3e9-4c5d-8180-d478b7ef60db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411869, "uuid": "0fb9c4b1-8f2a-49d9-b590-a8c696136e32", "value": "UaZ4NIOJgGSE1F3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0558a5-2606-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633457033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457033, "uuid": "47fb2a5a-7542-4cfd-b47e-44d222433ede", "comment": "Malware payload", "value": "de280893f1a89ab8d1d86f9d4cd4602a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457033, "uuid": "1b39fa2e-7bee-45c7-9044-01df1839afba", "comment": "Malware payload", "value": "60e356e6e4d31816a6f414841c44743e882d374a9c458b2a618dad4cd6632bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457033, "uuid": "35f675a9-8802-4226-a26f-6172ad2c0f90", "comment": "Malware payload", "value": "d685449c49face6468e495de64d5fcbfd82558f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457033, "uuid": "a896e224-2891-4298-b943-9190b4179544", "comment": "Malware payload", "value": "817a1afdf29542d9ea779b99c9dc4c110582d94d2e8f010694463690ad45af4d5b3b9a7678a29dc4473208504df3d18a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457033, "uuid": "c178ea1d-ce75-4e11-8776-049aab33b814", "value": "T13E54AE0273C6C0B3D8A641BA00578B3B8E7EA4167F36C5F76BE01D899D155F0DA76B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457033, "uuid": "1798b754-066f-49bd-9055-bd9bf7692537", "value": "7f7ccd5a4f25c1cac7831d174e43cc3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457033, "uuid": "b931503a-5551-48bc-b14a-48298f27617c", "value": "6144:KXvVGqCwiNhEKO/lMiVQTJyCICldgAO96:IHCwiNhErClua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633457033, "uuid": "f888cc62-bed7-442f-8972-f2d03418efe8", "value": 294982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633457033, "uuid": "56380b8e-20a5-4f4f-8a02-b1365fa07b01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457033, "uuid": "9e829f38-30bd-45f9-9068-43eb4cd19af9", "value": "KIX32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3a3ad6-25e2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633441523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441523, "uuid": "1dd5e5f1-8e18-4c14-a78a-be09e1f76d67", "comment": "Malware payload (RedLineStealer)", "value": "3a5a8ca56a4905008cde3e634ccf4646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441523, "uuid": "04c26bd4-d74f-49d9-bacf-46162ca2e17a", "comment": "Malware payload (RedLineStealer)", "value": "6223f08f2ea185a1cbcef1085ae6bddc64806e80a982acbe8cfb0056de0594a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441523, "uuid": "ca1df013-3137-4306-8ee9-bf8c98545865", "comment": "Malware payload (RedLineStealer)", "value": "c907339237fd7b2c1bcc515cfeb3c3b7a2e16c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441523, "uuid": "52d3ee06-6f11-416c-b5cb-d3fb47e7af82", "comment": "Malware payload (RedLineStealer)", "value": "17bf506790b7c62b09602d3d69754a7e372ca43032f1c05e2ad8bffc0923da71d8aa6d18bc9b3286d64d8ac09f1bb646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441523, "uuid": "d83f222b-7150-4e99-8a5a-a37239f1ed6a", "value": "T1AC64BF10B7E0C034F6B712F548BA93B8A92DBD70AB3495CF66D566EA56786E0DC30343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441523, "uuid": "5786b9dd-d301-4603-97d6-0907ed3fe0ba", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441523, "uuid": "bdc03ed5-3f80-4e8b-a5f9-65e70e3786a2", "value": "6144:j4u8gPQpVgbsOp2D2Agw0cS5P1PgoNIqNadKZgaoCpd2LGW+:jDrAVgbsOpNAgDB5PlgoeuS+glsdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441523, "uuid": "0500d1ee-2134-40dd-9c36-e16bc9d7d837", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441523, "uuid": "c16a27d5-550b-44ff-937f-05501d6201d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441523, "uuid": "0d86cb3a-9b4b-4d0b-b71f-874ee5510266", "value": "3a5a8ca56a4905008cde3e634ccf4646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d280899b-25a6-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633415896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415896, "uuid": "8dbb4f5f-3159-4471-81df-85ec75418ff4", "comment": "Malware payload (Metamorfo)", "value": "e7617a57e178dab1838e551f796ad025", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415896, "uuid": "95aa114b-16b0-4807-9700-7588dce4fbe1", "comment": "Malware payload (Metamorfo)", "value": "622acc203e6f80b14a18b34e3f099613af08b5b6808731d2eab6b91ca7c5f575", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415896, "uuid": "fdc7b3a8-c047-49f3-91a4-f12836065b20", "comment": "Malware payload (Metamorfo)", "value": "f93fab6e728bac4deaa4b42c51385032004b0992", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415896, "uuid": "4338febb-bc63-42ec-9c9c-3a72dc5e079d", "comment": "Malware payload (Metamorfo)", "value": "f7b6089e7e5ce6ef66981ebf43feb98f48892e8f32ddc93e5c024b6cb5ea1ffe4ae2905a2ac3154c1db9d0298f5befa0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415896, "uuid": "12f0df91-7f45-49d8-abe1-6d0ff1a5a961", "value": "T1E22112116BEB0B5DF16782727C328180573FB901F292D75ED898834C05B610865B9FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415896, "uuid": "7ad28ce4-df2a-47aa-bff1-c80b77fceebc", "value": "24:8Xi8+Bdnw/EMi/ABiFYdCEMBaqY4I0nJa9/hTG3tx2Dm:8y8idw/viIBndCvBxnI/9/JG3DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415896, "uuid": "72b22aea-b569-471b-99eb-c02240822a3b", "value": 1278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415896, "uuid": "493c979d-5606-4c71-984b-a31d3a7a6535", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415896, "uuid": "2ee1e013-070d-405c-a802-df9760fe386e", "value": "Dekort SE.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a7b6e0-25e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633444086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444086, "uuid": "4f493f7f-d624-4338-9990-7a48d3004b63", "comment": "Malware payload (Quakbot)", "value": "d442bcab9d31368d5e2d7bd049800136", "object_relation": "md5", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444086, "uuid": "e0ba593d-9b55-4a08-905d-4b7840915089", "comment": "Malware payload (Quakbot)", "value": "6349595b978d2128db7b3b406b141324c886653cdbf71a03b35b64bdc46268c8", "object_relation": "sha256", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444086, "uuid": "c33e3c97-bb02-4212-87a1-51df4098baca", "comment": "Malware payload (Quakbot)", "value": "47575ade3992f348e946f88cc755e4f1c32d02c7", "object_relation": "sha1", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444086, "uuid": "67b09f63-800d-4523-9a54-6d73106da88b", "comment": "Malware payload (Quakbot)", "value": "238f1120585c8c5a0b7f378db9554b1dd528d78bedc8af94a79070ac392dc5ac88f12b5cafffbcce3366807651cb9b7e", "object_relation": "sha3-384", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama109", "colour": "#9EC963", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444086, "uuid": "cf38bedc-183c-4edf-b085-6d33517b63e0", "value": "T1BCD3AD563797CA4BE54913398EE3879B3B72FC21DE72470332453B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444086, "uuid": "9a20f6cf-e3b6-49bf-bef8-b95ebd0c12a5", "value": "3072:3k3hOdsylKlgxopeiBNhZFGzE+cL2kdAGc6YehWfGutUHKGDbpmsii8u6ItC06vS:3k3hOdsylKlgxopeiBNhZF+E+W2kdAGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633444086, "uuid": "6c8a48fa-a1e4-4b21-88f5-c71dc6e5215c", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633444086, "uuid": "9e41db28-ada7-48a8-b5b5-b9c147d1aa0a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444086, "uuid": "c8e8c38c-2a97-4e3a-afa1-2036dee398c3", "value": "Rebate-1236948698-10052021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695a6c59-25ce-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633432900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432900, "uuid": "e46bd4aa-00c0-471a-85bd-2e3a7165c597", "comment": "Malware payload (RaccoonStealer)", "value": "d907de96adcb7c400834d974754ece57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432900, "uuid": "1a72007e-b11d-4e1f-9cec-1ac142860b11", "comment": "Malware payload (RaccoonStealer)", "value": "63cff2624610c0ba77145f4ca69ca649dd063e5da23b6f9534ffc643fe30b203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432900, "uuid": "a96ccd37-92c6-4dff-b4c2-a379c6ff54d7", "comment": "Malware payload (RaccoonStealer)", "value": "89cf58eb2fb76d42a1283c8068ac36adcc9d66c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432900, "uuid": "688d6d1c-efa3-4816-aad5-8a2c85a611d9", "comment": "Malware payload (RaccoonStealer)", "value": "7a91f9789d619103d7bca937dcfc86dad5d53afba8cbfa45758c21323e6fe1510f7936209787a28261aab33660132ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432900, "uuid": "abbda557-1389-4396-a74b-57a954e95670", "value": "T108A5235A73175106C520C3B2EDF77B510B60AFA65D228317E9BA722DD1BF33A985C2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432900, "uuid": "44ae7514-9a55-429a-9088-95c739650268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432900, "uuid": "4e1530f6-505e-4ad1-8389-b3dee74fdd91", "value": "49152:gHwokGmKN/QDrbeAtqA/mgWi9lSLis7XdzWJuHpaz27ZcS:iFtmKN/wbeADPHS4Juy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432900, "uuid": "0776d12c-b92e-4481-b869-5a9dbbd1e7b6", "value": 2210304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432900, "uuid": "d98926dd-cf5d-424a-ab65-658eb698f82f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432900, "uuid": "da010140-21e8-407f-9be9-5d8ebbea08a1", "value": "d907de96adcb7c400834d974754ece57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a3ec32-25a4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633414965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414965, "uuid": "482205da-4a6d-4e97-ad15-df19b672676e", "comment": "Malware payload (AgentTesla)", "value": "ffd7c817323ded9ab17c4e020fbc8d98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414965, "uuid": "1697cc89-8b3b-459b-9e04-bca88c88adbc", "comment": "Malware payload (AgentTesla)", "value": "63f1f675dfba6996628ec3e6ed448f753786013fa4e626fbbf75128d0adee6f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414965, "uuid": "b86aaf8e-331b-4c22-82cf-324c94090e5d", "comment": "Malware payload (AgentTesla)", "value": "ac21d64b6cb3d0ba316db73b7e521c629f60fdec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414965, "uuid": "244a8c8d-aa15-4221-9f88-92aa3a811651", "comment": "Malware payload (AgentTesla)", "value": "9172fa6ae5bb4396f237d698d6e7898ba8b0c1e21196c96c5825a2e53365a329fd8c65f256f82d5ac6ada809002246e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414965, "uuid": "427a829d-55ab-4d2c-aa75-baf5af53207d", "value": "T1F3E4D0A8CA434644DD384BB124395D6443B7BDA5AAB9F26C5D88B0F83EB33F7503185B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414965, "uuid": "3c7e79e8-1248-4a75-a646-00ec9044e900", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414965, "uuid": "1e8d0a15-9251-4bd9-9f33-3c2c4f4730ba", "value": "6144:4vQ+3HwOiVEJvzBdDALThiEOnHvCVvZE5J7uuUf7/5EA4QZzYKyFxg/qZfvbGiFP:4IoiMiD6KBZE3i75EIgxEobJy9NDN8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414965, "uuid": "91554e35-c2e8-4a87-9fef-7de5bcf2ccc4", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414965, "uuid": "d92600f6-658a-4851-afa0-32b3f9b3e953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414965, "uuid": "0e1b8171-5ef7-408d-8f43-802ee8489e7f", "value": "DUBAI UAE 20133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8fa136-25b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633422654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422654, "uuid": "2226e376-ef58-44bd-90cf-6e94e1aa3796", "comment": "Malware payload (RedLineStealer)", "value": "4c74c63093a2537ff1c96277f05eb11a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422654, "uuid": "c77b5003-2f35-4e0e-96bd-e526399581b3", "comment": "Malware payload (RedLineStealer)", "value": "64fa435686d94f74a3cc546fed84efea58c1ef60454ad9f60939960fadcbaa54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422654, "uuid": "baceb7bb-9ffd-43e9-a7d2-cbf8eb2b58fa", "comment": "Malware payload (RedLineStealer)", "value": "077a96b2be2fe3dd7b536903138ecbc3bc5ea9ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422654, "uuid": "02522252-7374-419c-bbbe-41c2adf0de73", "comment": "Malware payload (RedLineStealer)", "value": "b925345d4a0d070ee69bea8b904f605e166bb7fe5d95c2397e3a7f143414dead60a4e38f3dc388639604a63f4bd3941a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422654, "uuid": "9d0ef7f6-6232-4cdb-bd48-dc551db37677", "value": "T19F64CF1067E0C034F1B712FA49B693B9A82E7DB1673495CF66D62AFA16B85E0CC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422654, "uuid": "38e2be1e-bbec-4b6b-bb0c-b1746be3c5cc", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422654, "uuid": "3ff77a1c-fc6f-4a03-8b46-ed5c4c029cfb", "value": "6144:goxeAWHePvxmIfjBZJlhi5ZSlptcs+hvajfTZJjZ:g8M+3xmIJlhi5Z6c9hvajd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422654, "uuid": "faa1d9c1-556e-4ccc-988a-94aeafd4e31a", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422654, "uuid": "c305bd20-3a0a-4baa-abf0-8dd9fde61c65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422654, "uuid": "d020923b-57b8-45a5-a2d2-7b13c041c79b", "value": "4c74c63093a2537ff1c96277f05eb11a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45324a5-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437777, "uuid": "b6b34974-9530-48c1-a9e0-fe380e69fe1f", "comment": "Malware payload (AgentTesla)", "value": "3bd0c84206178cd77d9dc6c41dbe6d5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437777, "uuid": "8b8a045d-506b-4bab-bc16-0c2d193c77ad", "comment": "Malware payload (AgentTesla)", "value": "662f44bac212d4685773428caa1420fe58c760435e0a750bb6145728137c2c2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437777, "uuid": "c81d1df9-43cf-44c1-8cd6-ac3eb152e368", "comment": "Malware payload (AgentTesla)", "value": "c3ed80cbfd72d4699b579e17b28a3d4cf12ac246", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437777, "uuid": "e36be88d-c71a-47ce-b060-2739d6fbc94f", "comment": "Malware payload (AgentTesla)", "value": "4ba6bbdd99761c96e9a1ddba013759b52e92a68da96acd7a0db41ed25aecadad164dc36b86d5c3bf5fa0b3156349c02e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437777, "uuid": "2dd2d412-874a-4771-a49a-5264b7d1d6ab", "value": "T18F45AF2977AA7A91DC3C0E3AD813004083E18A675B77FE6F68F12EE61D1A5D79B0F111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437777, "uuid": "35c01856-345c-4a64-a1bd-57c610a18ec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437777, "uuid": "69c8bff4-479b-4acd-88e0-bf1219d9b8a4", "value": "12288:Fj6bxWadyaqvJysx2SsEP2iNHc1MwJ7D7OYyZUVwaCPKREIdIhOEKsabd1We:eyUsbs61Vcn5OY7s8dIhOEGbdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437777, "uuid": "a199b25c-788b-48e7-a79f-e0f07a349f4e", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437777, "uuid": "d6b6a6ae-c5c8-4a15-b2ae-a1cc386c19e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437777, "uuid": "471961ca-1bc1-42a1-9ebe-42548a221c42", "value": "FedExOVO PRA\u0106ENJE-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5619e8-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633411480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411480, "uuid": "7c8c40b8-747a-4d5b-bd75-07a6056e5039", "comment": "Malware payload (AgentTesla)", "value": "af80bb491caadee2aab36f673656d4d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411480, "uuid": "811a628d-7df2-45ad-bd1b-17be8567b60c", "comment": "Malware payload (AgentTesla)", "value": "666a4176c94d59dd14ed91c81258e2bb1c6deeb2bb9f39c0e92ece21ca4d0613", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411480, "uuid": "75444cfa-ced0-4090-926d-7cee2f6fccb6", "comment": "Malware payload (AgentTesla)", "value": "62bb827d4dee02a5f13589199c6404bc7b2d69b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411480, "uuid": "5ca7cf56-2a29-478d-851e-9aa28e6eb4d5", "comment": "Malware payload (AgentTesla)", "value": "7f3adf30907b1045b7ca1e12437802b9d7d36f7d71aace265b589fc1a76ee86c13f94e0efba35d7090744ab877a093ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411480, "uuid": "1a05dc9b-64f8-4838-8c1d-0c764976ca91", "value": "T123D4C5D053CB99C4B57B2139B0222CEBB47D630DF3AECF1151A77A938CBA750561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411480, "uuid": "a28c1bbc-9559-4536-8e83-94eccf4af694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411480, "uuid": "49cfb50a-54a9-4cd2-874d-2232ac195c6b", "value": "12288:f6YI046Mnq0UnsO5lJkKzUvoPUu9Yd+QCpScEZTn2r9pm8L0QXgKI:R7pQ5n2r902gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411480, "uuid": "150b0ca3-1053-432e-b421-edbf1bd0c9f1", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411480, "uuid": "2e5b81ad-4d1c-4228-9434-ebf594d54943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411480, "uuid": "2562bab5-13cb-427a-a2c2-7b36e354bda8", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5050d42-25a1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633413673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413673, "uuid": "5e23e4a3-b74a-425b-8e2b-24b1040de6a1", "comment": "Malware payload (RedLineStealer)", "value": "74c20cdca296271f3213985982352064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413673, "uuid": "f9ade824-1bf0-4af0-b6be-e24552ab386e", "comment": "Malware payload (RedLineStealer)", "value": "6673972ce5e63deb24ee3c524ff13c3bff9054f3953da1fc3e6205f7e95a1afb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413673, "uuid": "b018f291-0fe0-498e-a9ac-afc89d6da62c", "comment": "Malware payload (RedLineStealer)", "value": "60b23b6b9be65d50b41f147e18544026d60edb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413673, "uuid": "0e792a9b-f344-4147-9931-fc6acccaa724", "comment": "Malware payload (RedLineStealer)", "value": "79f1ee9fc2d3fb40fae37154a6188139143d809b21da67b2657d29fe08fd13cda6e3431814952e877b97df83814a6f64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413673, "uuid": "da751cce-b43e-45be-9689-b8655ca21f9e", "value": "T18C74CF30A7E0C034F5B712F449B583B8AA2E7EB19B3491CF52D51AEA56346E4DC30B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413673, "uuid": "f5e47de9-fa29-4156-b607-c20c29cf696b", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413673, "uuid": "eec2a61d-603d-4909-8cce-486ba3ba7e35", "value": "6144:mop8Jvgx8TA3W/zOGe7T2EWmpIJ+nRk87WgtPyHRbJEZWeQ2Ey/i7jkY/HeYA1FO:moS4x8TA3GnG2dmdRk8ttWtJ4EnjV/Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413673, "uuid": "81aba0bd-8bee-4c20-8358-ffb48d214f16", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413673, "uuid": "deccabcd-59c9-490c-a6ef-21e008f7c8ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413673, "uuid": "2cd25e6c-0b90-4c38-9bec-e1c73888fbf3", "value": "74c20cdca296271f3213985982352064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5806a41-25e4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633442450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442450, "uuid": "c49c1ee7-8a63-4456-aa36-e6da2eb89478", "comment": "Malware payload (Loki)", "value": "657edf01cd9100a52abd7a9d8e585a28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442450, "uuid": "79d57ecc-e7a9-407a-bdde-c43055778101", "comment": "Malware payload (Loki)", "value": "670e59f677706e51b84984f42f8f89229e294e4c482dfa4fc72964def42a3626", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442450, "uuid": "38c388a6-bf6e-45c1-8c20-4ed99f0a4fa9", "comment": "Malware payload (Loki)", "value": "47da737c89777cd1d08c5427d08ec3e77ef0da2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442450, "uuid": "6c8de394-10f6-4982-9767-da6545dea390", "comment": "Malware payload (Loki)", "value": "60b388f9e2d0e24328af41421cc71f6cf097a432b7393e122c1f2103a4be0c1f1ab8b3e0a61a4393ac4eb27716e4bab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442450, "uuid": "faa56805-8560-4675-bc42-b626a541b0fa", "value": "T1C7949D69322F5917CE288EF5185EA1C183F90C3B155AE7E85DCAF1FA65C3FB01A81493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442450, "uuid": "f0d34977-42d3-4218-8c59-265a94e914e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442450, "uuid": "acfaab96-712d-4256-9901-a94be9ab55f4", "value": "6144:FQq8qc0WpMge4UPvaMmdtq1a/tZFJYhVFyWpEGDNi0x7ynZPppgjQ+3HwO/A:FQq8qc0WfqaFq8tfJWVFL1Ri0x453o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442450, "uuid": "b8a57399-01b6-4e57-ba51-253a0df161e9", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442450, "uuid": "22107262-912e-4bb4-bf5a-df3ad1a399b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442450, "uuid": "619c0f2d-a836-4dc3-a492-1a0e63bc5f0b", "value": "657edf01cd9100a52abd7a9d8e585a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02b1c50-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437824, "uuid": "7a036473-6127-4c2e-abb5-853befdb4d7b", "comment": "Malware payload (AgentTesla)", "value": "28f18c69b3f3812bdb4694a5b96a6640", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437824, "uuid": "e81f2aba-cf73-495d-aa68-8412de8a4cd3", "comment": "Malware payload (AgentTesla)", "value": "67c9265e35d49aa6a88029c352cc11f72137d44c9d1a150e4b0f4c1b86024e31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437824, "uuid": "49b7addb-adfe-48ac-9682-850670946d92", "comment": "Malware payload (AgentTesla)", "value": "33bcda2480183f31a8dc26aabb0cb20e152d50a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437824, "uuid": "a7fd98e0-53c0-4f06-9e84-9100ffeeecd4", "comment": "Malware payload (AgentTesla)", "value": "e409c098bdd726be3a6dafb389d54c50897ebc720e84ccfd2027953e42a9bd01441063c16ba9355227bf5cc1d1b02d2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437824, "uuid": "731718ce-6f1f-4c3b-898d-def5e2db0d40", "value": "T176E4C5D053CB98C4B57B2539B0222CEBB47D630DF3AECF1151A77A938CBA750561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437824, "uuid": "2b6f5dff-1e9b-4236-9b3a-570220a0996f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437824, "uuid": "71fcd0de-d3f1-4829-97d3-d20b6ddb7e11", "value": "12288:DjKNI046Mnq0UnsO5lJkKzUvoPUu9Y/1S4LV3gntelKUUIjTtxFn4aSLFdNgivqA:QGYIQiKUNjRx54a+Ffgiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437824, "uuid": "edca5a7d-fbb8-44f2-8ac5-fa870a99aa03", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437824, "uuid": "031261b9-5387-4e1a-984b-ed7f8e7af559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437824, "uuid": "fd2c8337-cde2-4408-81d0-3059dcd09ee6", "value": "Kredi Kart\u0131 Hesap \u00d6zeti - 4508xxxxxxxx0018.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd646f4-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436959, "uuid": "ccdb6233-6572-4942-96ae-c208d35ef396", "comment": "Malware payload (SnakeKeylogger)", "value": "d09931ea6cf07084ba1493832a95f929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436959, "uuid": "3647dd36-7c19-4494-8537-3eb21b8e030a", "comment": "Malware payload (SnakeKeylogger)", "value": "67e968a47085d54e84baa21a988984d5522f464f2475f542a47236c2a71505c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436959, "uuid": "6aeed0cf-1fc1-4949-8ff1-2e611b37bdd3", "comment": "Malware payload (SnakeKeylogger)", "value": "640ed2e47238150d3f75d849cf6cf8f2beaa111b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436959, "uuid": "ce356988-d2d9-42db-ab7e-5b8b423c089d", "comment": "Malware payload (SnakeKeylogger)", "value": "1719705e261822978dd95b33d48daf9932a9d95febd5116d9b5b59b793e92e8c218f99d7b4e8a1db8717a031b9dcd0c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436959, "uuid": "5a1043a3-a4f3-496a-b32e-6a0891869cec", "value": "T1A9F4F5394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436959, "uuid": "23852096-e814-4962-8bee-88c40f7cbcf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436959, "uuid": "9f43352d-76a1-4f16-9896-b72074127c9f", "value": "6144:ZjXNJMAl28X/9Hq/2tVT2bEAGcPbLgtcRg+6KR4:Zj9JDl2k9HqBEAGQg+IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436959, "uuid": "5f6528fb-4ecc-427f-bf16-8ba42ab711e9", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436959, "uuid": "54f8c7e6-ad6c-418f-9d90-88f4a1881403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436959, "uuid": "5d7eb1b4-16df-453c-b6f1-9955795bbdc9", "value": "d09931ea6cf07084ba1493832a95f929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2865f6a6-25cd-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633432361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432361, "uuid": "67ef55bb-9e0a-4a3c-8538-4fdccbf6cccc", "comment": "Malware payload (AsyncRAT)", "value": "909b828a4aa8b8cd2025115944d5a0e1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432361, "uuid": "982d414d-3dab-4909-88e1-9104c7c4c2e8", "comment": "Malware payload (AsyncRAT)", "value": "68e3f3168f0152c5f36a66987adee078b98a44562fe780a668859bd1e8bedd3b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432361, "uuid": "fa2d0804-3dbb-44b1-afed-16c116282f60", "comment": "Malware payload (AsyncRAT)", "value": "7a6288642a67519bb7c2f49fb326f7e44cbc3873", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432361, "uuid": "bb225dd0-e6b5-4942-9cf5-f7eb3ef01f56", "comment": "Malware payload (AsyncRAT)", "value": "af53a51f329cdf598a4cc10afa47d7c7c2183e5012c2eb56392a454b76105f5caac00cf28ce658ac96f0af22f10eb0f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432361, "uuid": "b2ef1a17-38f9-40a8-8bb6-e9f7b7d5407e", "value": "T1AEB472D053CB99C4B57B2139B0222CEBB47D630DF3AECF1151A77A938CBA750561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432361, "uuid": "045ec0f3-3b55-4de8-8782-13c70e52c5aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432361, "uuid": "0645b4ba-93b6-4b2d-b03c-8b9f383baf74", "value": "12288:2WUXI046Mnq0UnsO5lJkKzUvoPUu9YQiouzKxr3kB3eOE:2xZizurYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432361, "uuid": "ef530fca-46fe-43cc-8d7c-85178a129699", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432361, "uuid": "808a71ad-7aee-42f5-9e82-0f0b26ede423", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432361, "uuid": "df9d74ec-131f-4f4a-8914-758affffb87b", "value": "Application copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d70068-2576-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633394959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633394959, "uuid": "42df5332-c510-477e-b8bb-9042a02dba13", "comment": "Malware payload", "value": "1b2016c135200cf451366c17494a3eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633394959, "uuid": "a60a5cf3-9698-4c85-9143-e6545cc542f1", "comment": "Malware payload", "value": "694265b2dc50bce5062d298872ff396dfc0e054017ecc209a6083faf8ddee107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633394959, "uuid": "5150afe3-69a0-4d43-82f6-2fd6f3d1b092", "comment": "Malware payload", "value": "b29148abf9256c191b05c203e3852fd031126f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633394959, "uuid": "8f4a7602-ad08-4932-a1c5-07e37f977bcd", "comment": "Malware payload", "value": "22646202c11495f17102dccd459aa8b84cfe2e40592f16067fe397a83f11fd85440a93a919d5b791a06a78f2bfd18267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633394959, "uuid": "ede8a405-0128-4327-845d-34e388bf0381", "value": "T107B533BF33C96C4DE7C930B5DB076FA6932A89CCF2BB9210B7064A5E4D0728741E9516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633394959, "uuid": "1195b47e-6472-49d0-80c0-05459a532edd", "value": "9eeb1d659080cca4612552eeb0e426b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633394959, "uuid": "0c0e8b68-a618-4327-b4be-9f9b562d45fa", "value": "49152:mNy+93Ikw1xIokPJQi58BYH9zg9MASB4lTTzh46lxnNsQSv79:m4OYkeIokht8qH9Ez62rj279", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633394959, "uuid": "a8e42ce9-0ea2-45eb-beca-dea6b8c07092", "value": 2412618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633394959, "uuid": "9a1ce66c-0394-449f-bec1-b07cc100a77b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633394959, "uuid": "283e5f32-8ec8-478c-80ab-71bc1f757d48", "value": "SecuriteInfo.com.Variant.Razy.909711.11286.22820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f749e769-25dc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633439151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439151, "uuid": "cce65e2c-a473-4763-b071-c0e8c21c4001", "comment": "Malware payload (AgentTesla)", "value": "8028e5ee5ee4ba8d7bf5d19442191641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439151, "uuid": "0fde906a-33f3-4eb4-a6de-b30c0bf48212", "comment": "Malware payload (AgentTesla)", "value": "696e161a2f8f6741cf7912370ed890ac093eaa7a5285fa74bf83050da2d32b53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439151, "uuid": "afa5123f-0781-45b4-9dcb-ae033ab07651", "comment": "Malware payload (AgentTesla)", "value": "b2b436b18145e9c6c17f021767543787a09c4c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439151, "uuid": "f71e5674-1f6d-47e2-bc8c-e148305f47e7", "comment": "Malware payload (AgentTesla)", "value": "18ab651faa949f2a8f5bf96783300e6263e461243d610fb7d81a76278c5a98a412f0dfcdae1774eba7b859948e0bd5cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439151, "uuid": "31791662-cdb8-492f-97ee-f90462a55ed6", "value": "T19BC48CAC761375DECD27C1B6DE686C64EB6078BA530F8223901351ADAD4DAA7CF500F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439151, "uuid": "231aee1e-40ec-40a3-9148-89ee2f44a97c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439151, "uuid": "9cbdb3ce-1338-489e-92eb-528e3df7a80f", "value": "12288:t/wZjK8AA6RQKoHSnbyoMwZSEyh1g/Eofya64FHLFfgNXYR4o0V:t8h96RQKoynbyoDZqhWsVhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439151, "uuid": "73becb14-8afa-4149-b99a-3e916c25caed", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439151, "uuid": "d8c9a536-b0b3-4a31-ab7c-2965d12d4521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439151, "uuid": "c89fa428-f2de-41d5-bf21-1e3c89da6a04", "value": "Invoice20210510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21657b0d-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633424189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424189, "uuid": "73336b06-2ded-4b35-a18f-f964a93767f8", "comment": "Malware payload", "value": "58514092e1e6d885d966c5096520826b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424189, "uuid": "a59b1417-a953-4991-8feb-137d4ac361ef", "comment": "Malware payload", "value": "697c77dfb6b077d0b44c7665607db612b7fa92006b78aca8ff422fc2dfcf6a0a", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424189, "uuid": "b82e29ab-3182-4380-a712-e7a659fd0697", "comment": "Malware payload", "value": "b700184bef1ade35f960e29d8504be637eca4652", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424189, "uuid": "b1ba7152-eca9-4c0f-90a5-1ec2a564557b", "comment": "Malware payload", "value": "b79aaf239edc9dab5f68174e62d6ed4a08d723ed7b79d6e0f45949f9cd77704c35f104293908dab7edde183108d02001", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424189, "uuid": "83730db3-64bd-4f90-9a8e-a27d8e84d23a", "value": "T1E4F3F13B4266841EEA5F84FB21FD0DB643B23F1412A0637A9EF6E21D3A575B1DF12046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424189, "uuid": "30c31b85-6684-4f34-a0f8-cc4da9c199ad", "value": "3072:wSpj8h/9HfSlT8mOxNhrwZtWZ8Ps2TpGUv+6aW0ru4+spChu:Dj8h/JfSd87xS910xmO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424189, "uuid": "f1c1a420-fc18-4aa7-8ad6-1bea855890ff", "value": 166443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424189, "uuid": "577ebf7f-a316-4d14-90fc-72c8ba8fae39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424189, "uuid": "9bf58b73-f879-45ad-b613-70ec41faac1d", "value": "Termination.981528_20211004.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d865d7a-25a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633413982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413982, "uuid": "6131c591-04fa-4395-ac60-62337801c523", "comment": "Malware payload (RaccoonStealer)", "value": "47933f53ba1d7533fa656bc46bb58110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413982, "uuid": "cf587d61-2d82-4624-b70b-cd96be7e268b", "comment": "Malware payload (RaccoonStealer)", "value": "699bf09631bcd5e12619db6bd87b094a51bd053815a419247f8824bca921c19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413982, "uuid": "03874d01-e36c-4ba1-9d94-a38ea01e682c", "comment": "Malware payload (RaccoonStealer)", "value": "c86b105fde34b83d0d72af4b1ec7a30f9fddfdfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413982, "uuid": "2fc5063a-c113-423c-af49-b60561025ae1", "comment": "Malware payload (RaccoonStealer)", "value": "06254c8b622e9f2fdddf234d873549a2d06a3d83f7bd9da09c17581d87b8215298edaa2c4faf1a47b3b122b25f572782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413982, "uuid": "a12d871e-23de-4908-acbb-2b59883cf20a", "value": "T11144AE1131D2CBF2F6670570A9A1C6F49B3ABD6D2D22714B3790371F1F392E28A26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413982, "uuid": "a6e5f35d-aedf-404b-bcbb-f565e9bc04a1", "value": "8edc63b1e502813168c877f42e306db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413982, "uuid": "ba891b1d-dc27-4697-b46a-11d1c002338c", "value": "3072:kbPw1MG1mH9nUDA1tFZx2tjFkHletdfpaZkIaepL+8ESIO81Yl0zl19pwoJp4:kbP61mqk1jZx2n19qXLySn0zl19pDJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413982, "uuid": "29f8250b-63a9-4acc-80d5-d75ac2d5414b", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413982, "uuid": "e08ed4a8-6443-4f18-9577-6f70930ec76a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413982, "uuid": "780ee9c6-ea57-4cbb-90be-60991b77c4e4", "value": "47933f53ba1d7533fa656bc46bb58110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfe9cb1-25a3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633414572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414572, "uuid": "0e60215c-1275-4012-a167-344a498cad0d", "comment": "Malware payload (RedLineStealer)", "value": "d1b777e6efc74d3acdf5bc17da7b5107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414572, "uuid": "711f0b6e-91fd-4b2e-b219-aa08b3d7e772", "comment": "Malware payload (RedLineStealer)", "value": "69a9ded4f74e191eec40ecb64268926a05370d82ccd635f73b5e787402b9663d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414572, "uuid": "4e8107c6-6bc4-4260-8f5d-5e342df3430d", "comment": "Malware payload (RedLineStealer)", "value": "645e6aca45b5641b3a44650c1840a2144c0ac576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414572, "uuid": "71d7b0ab-e028-4854-8a64-7721ff44190c", "comment": "Malware payload (RedLineStealer)", "value": "04ebdc4b797663d62b81a495b3f8c770d45a39643e77e5b74d4c733137a89dd10bba93a11b48d6b5d2fe2f1b026efcca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414572, "uuid": "1de0c9b7-c53f-4d9b-9b25-97872903eac9", "value": "T1A574D00171A3CFF1EA6246356925CBE48736BD6D3922718B37943A1F5E393E1CA36342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414572, "uuid": "00125fd9-7281-40b3-9a64-a718c8fd9457", "value": "8edc63b1e502813168c877f42e306db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414572, "uuid": "3cb9910a-7a10-4f6e-b711-f3e82ea3fe45", "value": "6144:O6qS85BMwnHrvifl9gc865YXS92fUXqcqSn0zl19pDJO:SS85BMwHi9gc8MYXSign0B19b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414572, "uuid": "700d611e-ad23-4a56-b824-6aba64697fb7", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414572, "uuid": "b054bf78-2c5a-4b41-9d7d-e468ca128a64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414572, "uuid": "7cee5be1-ac01-494e-91aa-ab8f6f10f962", "value": "d1b777e6efc74d3acdf5bc17da7b5107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24db57c2-25cd-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633432355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432355, "uuid": "11807a2d-e97a-49a8-b701-d09dcb0c1a9a", "comment": "Malware payload (AveMariaRAT)", "value": "89929e2700518413aee6066b7246b8ff", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432355, "uuid": "2c1221f1-213f-4391-ab94-e2928fc0af5e", "comment": "Malware payload (AveMariaRAT)", "value": "69d9062b30ddf23eadc129496f5b30a2ac19ff83b2e55148eb6d2a6f96c61e2c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432355, "uuid": "48b729f8-f49f-4d51-826b-8c29c2064a97", "comment": "Malware payload (AveMariaRAT)", "value": "0f9ff24fc479fa771b5a716e2cd5c1649a989389", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432355, "uuid": "f487d43a-dbb1-469b-8574-fcf8b87de998", "comment": "Malware payload (AveMariaRAT)", "value": "cb106c75c5f2a1b7aaab9ef0b10eb3be9d51ba08a1c9a1c119cf364f088dc3954fd82a90fa09e7000d22d1de285559bf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432355, "uuid": "411401f2-7c5c-4368-9903-03c764fc094f", "value": "T154A4DF52EBF2EE35CA71043F9255B774AFBE0E9041B23D4A321CB6353EB9D05894528B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432355, "uuid": "1fa2ea5d-c965-4ece-a8d0-463ab9d625a5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432355, "uuid": "0186655c-19d2-4b57-9dc3-7d226a1f4194", "value": "6144:a8LxB2S5zLU6z2SqlBllTY+KUGP4q/FjZp:PzLU6z2jplD97cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432355, "uuid": "0ac9f799-0aac-4348-b054-49af35fe16b5", "value": 465593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432355, "uuid": "bd615d9c-666b-485a-856b-1e59b63ddf56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432355, "uuid": "16835ea7-4d0e-4e42-bb33-25e30b5a532e", "value": "HAWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c71b9b-259e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633412114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412114, "uuid": "64b24228-9e34-4200-882f-59ddd22624b4", "comment": "Malware payload", "value": "ab64887df3be089d2781aa64fb5a06aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412114, "uuid": "fd0d2b6f-fea9-4a16-bf5c-a9c529aa4fa6", "comment": "Malware payload", "value": "6a331cb93934e463496ea94f384337df1b41e6b210db16973b82757a4abec256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412114, "uuid": "f967f263-601e-4d77-b943-b9634b2baaa4", "comment": "Malware payload", "value": "35890b7362ed0072be80fcf45153842375bd27e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412114, "uuid": "24e90188-0ece-40bc-b32d-04f85b75b3a4", "comment": "Malware payload", "value": "4de217c69175c46cf5748d7c5ad53c3d11d86897e765006aade0d545499c06bbb4457a406e3e0ff3ffe08d2c744f1919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412114, "uuid": "04f9f60e-f648-403a-972c-52af9e124214", "value": "T1E9B42218A36BB636E55A95B4E2D3398C93B312C3FB14F5668FCA59F45903BCF0318429", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412114, "uuid": "9852ed0f-6a1c-4683-b242-761049a9cff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412114, "uuid": "6aa429ed-4b48-49fb-b38a-3d38ebf205a7", "value": "12288:ADgUOPOh9FloV+R1R3IvHkaYm0I4uV3Bukz2pK2:ADqklm0jYM64uOp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412114, "uuid": "8c0d9a30-1d4b-4ffc-ab51-0b051429cf22", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412114, "uuid": "dfc2100f-85b5-490e-83b2-ecdf54edd0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412114, "uuid": "3f66d6cd-2a60-4425-836d-d233b5acf036", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2570582c-261c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633466287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466287, "uuid": "69e76d2c-5b5e-4b67-8f67-60bb13c2d2e8", "comment": "Malware payload", "value": "64e1aa6f5dca669ba51678157058d54b", "object_relation": "md5", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466287, "uuid": "55f2ef33-cd39-4b01-85fe-f2dfe2eedf05", "comment": "Malware payload", "value": "6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286", "object_relation": "sha256", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466287, "uuid": "9dedc1d6-6e61-4c54-99e3-9f88f1ce1bff", "comment": "Malware payload", "value": "9f6df0a011748160b0c18fb2b44ebe9fa9d517e9", "object_relation": "sha1", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466287, "uuid": "668a17bb-da7e-4748-9fa7-3e8617b60436", "comment": "Malware payload", "value": "6d5e2324528b0c05705ad73dc8834723e923db577606fc827843014460a121e44839671cb98a357f13e460b8797cd3e1", "object_relation": "sha3-384", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466287, "uuid": "342c6492-6fd9-4227-b83b-50ffd42f98a9", "value": "T13783BFD10990372ADFBF5E72E0629A9CA6F7C53B7C17C02E74D103D80EB9B8055DA225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466287, "uuid": "ca024569-25ad-4c7b-845e-9afe0a24b862", "value": "298dcf923984bab305f7bca926228b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466287, "uuid": "615f2c5f-eec0-423e-9390-1b546d1e259d", "value": "1536:esDWvcIU3ayXD1D12E5G9JR0+iGxxUWfdOzq3bdPOoH6LBqtgkdd+4MxUAsKliwZ:WeayXIJR0hGvTfMwfaLBViYUAzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633466287, "uuid": "fa989a28-ddc0-4c4f-b24f-1f0307a6b26b", "value": 85696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633466287, "uuid": "4572a879-a69a-45e7-8a7c-9717e45f3f4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466287, "uuid": "14793438-af2f-4202-9af0-818f4bb89970", "value": "6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9135d27-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633437758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437758, "uuid": "18583af9-2af3-478b-ac0d-8886107f17bb", "comment": "Malware payload (Formbook)", "value": "91e8bdf53658932e3ba208d29b698b96", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437758, "uuid": "a23d7544-8b04-40bc-bc7e-61183d982b43", "comment": "Malware payload (Formbook)", "value": "6b63ec46676c5907973403b1dde8476aba820788e7aadf87e3eed70d30a33b59", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437758, "uuid": "b005d037-eb46-43c3-99b7-5aa001d74b9e", "comment": "Malware payload (Formbook)", "value": "c28c9d863d05557f887a6e0de1830b85974c2855", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437758, "uuid": "2a0a4615-f4a9-4c86-8f88-31d9004b4f87", "comment": "Malware payload (Formbook)", "value": "d0b6255e7aa03fa83ce8decabe37e907af8c6a95e3e99bdc0a8b17929e1def9e6490bb5289d2d90403abb4c5b2d40a23", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437758, "uuid": "fdda0ea0-7fc1-4179-a63c-72415bd90b83", "value": "T172258C2233DD1A68F87DA378D521445007F2BD16D729D65B3CD221EE0D79EC3AB2A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437758, "uuid": "0125ab09-20c1-4eea-9cae-60e2dbb66cec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437758, "uuid": "942bdf7c-3fc8-4eaf-9ad5-760dc247cd60", "value": "12288:Wcx2iNHc1MwJ7D7OYyZUVwaCxxvnY9WCvfiiniNUX:71Vcn5OY7sDfY9ZRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437758, "uuid": "a1532a39-0107-4565-860a-bc554a76827e", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437758, "uuid": "0f704a8f-f238-48c0-bdec-fce1f9c71531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437758, "uuid": "3c19d3be-ce2b-413e-9622-46c3636ff1d8", "value": "Se adjunta la lista de pedidos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f2242a-25cc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633431975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431975, "uuid": "f2803ac0-d423-4541-8795-e356b728805b", "comment": "Malware payload (RaccoonStealer)", "value": "69cf5cfbd84bb16fabefb68e44f94625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431975, "uuid": "b8f21c71-4325-4e56-8676-c8006ad4b3f9", "comment": "Malware payload (RaccoonStealer)", "value": "6c99fe3d55395e3660334d608e8a1b60e71e3a52dbde42df2b1f465276492f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431975, "uuid": "e5fd4c1f-611e-4ec7-b416-4c2f6931b9d3", "comment": "Malware payload (RaccoonStealer)", "value": "c15e7d61a1b8493539035d6adf72c9e7ae3e451e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431975, "uuid": "b0620b89-125e-4e56-a459-1b70c3e0b918", "comment": "Malware payload (RaccoonStealer)", "value": "4ac519d8d8b66b512dab21067a9a5e1554f9c0f2ca16df5c05c98a27ae31fc53bf89e8368d479bb3df5b1b312d428d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431975, "uuid": "8cd2772d-7f2c-4068-9661-2666aed91751", "value": "T1C134AE1067E0C034F1BB12FA49B593B9A92DBDB05B34D1CB66D52BEA46746E0EE30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431975, "uuid": "0bd1b8cf-4666-4f45-93d8-2de0bc574bcc", "value": "bec5279be0cb3c653f5b0b143b00a99c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431975, "uuid": "cb37239f-9c6f-404d-963f-be93b14c9b58", "value": "6144:p45eUW6n/pZ3z7O/nzlDJ1glr0tjOuYIQ:pgUY/pZ30nztJylwtCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633431975, "uuid": "d3b29b2c-7510-465c-b5e9-b01723116fca", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633431975, "uuid": "1afd4b0a-2646-4a2b-9cef-1eabe046adf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431975, "uuid": "ef54da64-281f-4074-a068-2cc60355e7c5", "value": "69cf5cfbd84bb16fabefb68e44f94625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af931244-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633437313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437313, "uuid": "67b15b42-1037-4371-a479-5f86ceac5dfc", "comment": "Malware payload (a310Logger)", "value": "e0703c9aafb974243d908920f1f2c931", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437313, "uuid": "697e24c2-2a97-4efc-8bc6-7116f481b30f", "comment": "Malware payload (a310Logger)", "value": "6cea03f6081004129358e0be04eada75ae183d23d7e65b36c286d0cc1d5f6bca", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437313, "uuid": "41e5fd6d-5a1d-4dec-82b5-5f8592ee7f70", "comment": "Malware payload (a310Logger)", "value": "cad5ee81344414cabd6e611dba3890a3996ab3a0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437313, "uuid": "ba7ccdf9-334a-467f-bc4b-397aee01995b", "comment": "Malware payload (a310Logger)", "value": "2d1bd58929113be3669d14e8d54368edcc9f0849cb8827339e61306d88194f9180fb3919cb57d4435a4085270c0e94c7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437313, "uuid": "f2824550-33ab-4bdd-9319-0dba6c96c381", "value": "T163642291B2C8EEE7E3031BB64B8C675451409CC2EF37793990B8B29A32F67651967431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437313, "uuid": "1c7d99af-e52f-4159-aad7-c69ad2ba4d9b", "value": "6144:KdSmMzoYGUe3y0GauSnC7O7C0umtr3fsSjYOMS0rrcgDHS0aByTe33xl:XmMztanSbmVfsAYOV0UWS0ZGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437313, "uuid": "32194be9-3bb1-42e1-b276-cc761fcadec6", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437313, "uuid": "214c35e5-dd79-480f-8b4a-eceed4c9aae0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437313, "uuid": "fb2055ed-1634-4814-9089-3934a43782ba", "value": "RQ-7436819.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dd52d2-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mimail)", "timestamp": 1633412035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412035, "uuid": "9fab0be5-0b33-4a1a-817f-c2d19f6420fa", "comment": "Malware payload (Mimail)", "value": "3d240953970b88dff873b9822460d8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412035, "uuid": "ceff8538-eb60-4f4e-a8d5-68b68288cbd4", "comment": "Malware payload (Mimail)", "value": "6d4098bfecaefd9b0180a9335dbc696464d893d16416afa5cc24dd12173c0bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412035, "uuid": "1f01f6c4-5b7b-4486-a602-ce21bf8c702b", "comment": "Malware payload (Mimail)", "value": "2f817e10f3cf73be2b52ecae0422ec698a8a72e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412035, "uuid": "55a96081-c9b3-4c29-a1f8-ccd0376689c0", "comment": "Malware payload (Mimail)", "value": "4ca5f339622c27e507970cc0f1d4640f5fdb7e5b19898ad1880ee3315962e6274ec46e46500fb8ad71519e476d675136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412035, "uuid": "8d20ecad-e26c-4439-8849-d7dafed8be8c", "value": "T11DD3F1DF47F448A4F8CD5A358FD6C77342B6335EE22A601F1E2ACB47846328758629E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412035, "uuid": "b98a54db-c892-4c04-923c-13f0dfeeb818", "value": "9c0050334da711b5147027326c52827d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412035, "uuid": "d189f3ee-c434-4f91-bf78-72d1d171fea2", "value": "3072:CvyaxMUfAKO/NYQYAziKtLc6BjJoZ8NYQYAziK:CvhxMUfm1YszHxhBwcYszH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412035, "uuid": "80e7a234-6541-43d5-9eb4-7e33ae8ad2ad", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412035, "uuid": "19d32b80-8056-4fa7-b4a4-60c573531d2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412035, "uuid": "d42939e2-5163-4a48-bb52-62a4b53b65a8", "value": "theaction.jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5e6053-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633412151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412151, "uuid": "b249cd52-7102-47db-8cfc-b2343096de77", "comment": "Malware payload (AsyncRAT)", "value": "66aafaa133083ab4fd2c354c700ff2c4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412151, "uuid": "215836e2-4649-49ba-a4fc-6e927d4b9c8f", "comment": "Malware payload (AsyncRAT)", "value": "6d51155cb8726100f39bec78c8816f4bf057634080617ea569299656e515e4bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412151, "uuid": "a8400ae6-0454-450d-ae91-1ef7cf5b9273", "comment": "Malware payload (AsyncRAT)", "value": "f4391c8612fedf4a056af7bb9d9ad3e7452ca073", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412151, "uuid": "20280dab-36e3-46dc-a349-c7f77ffb51ce", "comment": "Malware payload (AsyncRAT)", "value": "edc219e16bd98c02ba1367b5229fefb23056d9c2db6cc71ad2ab4188cbba18aa2a0250aca98e81d4d74135c8dd8acf17", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412151, "uuid": "ca227289-13df-4988-a787-59462d5d70d3", "value": "T156B44BAD361375DFCE57C1B58D58AD74AB203CBA570B8207501731EDAE3DAABCE140A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412151, "uuid": "f3a87542-9c63-47af-b14d-23c40fff2cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412151, "uuid": "6b823e94-e7b3-4468-8610-0113e8485988", "value": "12288:1py5ALvpb8VJdlJIHnnKFrrAEmX6no5MjvLe:1E5ALvuVJdcAnFvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412151, "uuid": "713df107-e18f-4f3a-b636-833a333cbbf7", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412151, "uuid": "9b65315f-e35f-475a-987f-369c6951486c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412151, "uuid": "40014d00-a239-4483-bde1-0dfb04d5ae14", "value": "OsX7mAMX3oKoRNE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b712998-2614-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633462995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462995, "uuid": "b4147fca-336a-4646-9946-e148e4e4e9c3", "comment": "Malware payload (Loki)", "value": "afed50ea4e5a307daa1327dc715b85ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462995, "uuid": "9137c1c2-fa76-4d37-823c-655ac8bf798b", "comment": "Malware payload (Loki)", "value": "6d84079d238505c8842072cafddb8bf2ffcd4a71e6bdcbc38f0a8c9afd9eda19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462995, "uuid": "009dcb4c-747d-459c-9c76-6229283bbacb", "comment": "Malware payload (Loki)", "value": "c0875b224300718ce46aa0934f1355bd57737940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633462995, "uuid": "45af0e2f-093e-45f1-a78d-358fdb762aa6", "comment": "Malware payload (Loki)", "value": "93524442a14f710947fd59df8c3c43da2a9280b35ff6e5830e900b24723781c523fe99968755bcf8c736a5aa242545a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462995, "uuid": "136b5ede-bbe0-4a1b-b42a-358ae345ac1c", "value": "T17654234503C18DF7E5AB1BF789F7B5AEF3B5050080125A4BD3FA0FE72966606906A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462995, "uuid": "cf9b535b-91f4-4996-8b25-a409665069c0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462995, "uuid": "5bab65b7-0ee9-4636-9c92-e22e00a54a71", "value": "6144:F8LxBsHkpddze71M8qgQWvOJrOnnjru0XpcrUiMWv42BFGFfbZlLUSyjEMRqg:/E7Qy9FgnjjA/ga8fPLCEaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633462995, "uuid": "e94c2403-124a-429f-bdc7-4f8a44fea6f5", "value": 294140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633462995, "uuid": "fa57651f-fd6a-4487-8b5d-1a4a0a7b2c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633462995, "uuid": "1ebf2825-41f2-49fe-a3cf-787618a0dbf1", "value": "afed50ea4e5a307daa1327dc715b85ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0649a0c3-2638-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633478260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478260, "uuid": "574dacc7-b85a-4b19-9c71-f9b9fa9d2940", "comment": "Malware payload (RedLineStealer)", "value": "21f82ef80029b7096f06df17f57eadc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478260, "uuid": "7801de90-88cc-48ba-adb3-ea50e276d190", "comment": "Malware payload (RedLineStealer)", "value": "6da6c7c394e922f31d883030afa90848edf21a5bf7c5f36f2d8ceba1ff97d028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478260, "uuid": "26459a73-73f8-4d33-92b2-c49c1536b590", "comment": "Malware payload (RedLineStealer)", "value": "5d5394f6bf4dc271f7d81a11b544935583353a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633478260, "uuid": "924d83a7-45b6-46d3-bda2-cdfdeb786cfc", "comment": "Malware payload (RedLineStealer)", "value": "1a2a52604ba73d6c23a45e3fbdb35ea6cc9f20663060d97b977cc5a08f1d58df277b3138b00f86283f8e8683e6583575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478260, "uuid": "88412349-fb27-44de-828d-e05045381f8c", "value": "T1AB549E30A7A0C035F2F706F845BA9379A52D7EA1A73451CF52D42AFA46346E4EC32787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478260, "uuid": "4cb1d6fb-60e2-4f40-bb46-72e301f469a7", "value": "af44dcafed165daab29f132f710193c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478260, "uuid": "d8c287d0-5775-4d5f-b040-e765ce494cbe", "value": "6144:p0mhPRr6GjRxMNcoHz7tM9Arwd5DS6/k6NvrF:p0mhPRr6GjANcyzUdM6/HNvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633478260, "uuid": "ad9c4276-5316-4500-9423-9d4c5d1dc72e", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633478260, "uuid": "90c9078b-1ee6-4cb0-8390-43f0560539cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633478260, "uuid": "6d789f46-3123-44e8-84fd-b1072e4fc5e2", "value": "21f82ef80029b7096f06df17f57eadc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bd5b3d-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633436954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436954, "uuid": "a9ecf0ba-8096-493f-8175-155978a97583", "comment": "Malware payload (AgentTesla)", "value": "d62956245f0d62d3b7162c7d29ab9869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436954, "uuid": "828bc69a-33f6-49fb-aba4-5d42f67c9970", "comment": "Malware payload (AgentTesla)", "value": "6db0408dbea7597c80fad815d8b4d4eb36df1c76dd0319f77807032f5a5660c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436954, "uuid": "0c3c6345-ea2e-4944-86f7-7e18a63b8ded", "comment": "Malware payload (AgentTesla)", "value": "a8532b0b26db8f5a6efd20d6b3d88a124ecdd08e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436954, "uuid": "d0f65402-4809-49c7-9807-e05170d40620", "comment": "Malware payload (AgentTesla)", "value": "4f507e1beaf6b706623c02cde147364055d436d2f99db9e0c80d072af4e9fc685faf1cc316b98910c04313d8074810db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436954, "uuid": "18408314-1d6a-4612-8b30-00cc3ac6cd4a", "value": "T11E848F23B6557145EA220BB0CCB66AFC5A257C550C219E0734E9BE0D1D72AC36DBF32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436954, "uuid": "1ab1e0b2-f17e-4557-aae2-98964fef31d9", "value": "fd665c8501eb1a152d6b80cff0d63b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436954, "uuid": "d5ce369b-7386-477f-b4ec-cfd10c943e19", "value": "6144:hCYLIwzZEKRv25Q0y3pOhNFFd5sOa7TP+XR:UEPREQ0gpmPFYjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436954, "uuid": "14646dda-8c40-47af-9f79-3768aecf1c7d", "value": 372143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436954, "uuid": "c20fb388-818b-468e-9b88-2265fe5ecd93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436954, "uuid": "1c1c8f23-1060-4674-8169-10010afda1e2", "value": "d62956245f0d62d3b7162c7d29ab9869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511c8940-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633413102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413102, "uuid": "e712b032-1966-4a9d-b052-5b54f46fbdbb", "comment": "Malware payload (AgentTesla)", "value": "0cac5b262aa0bdd89b47582e261a3cb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413102, "uuid": "04fcc870-0a98-4928-a17e-4e4db98cc1b5", "comment": "Malware payload (AgentTesla)", "value": "6df03da9ec44c507273dc8fc3132b8deab8e99172d3fbcebd74b97081fea7b62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413102, "uuid": "c259c49e-7acb-464a-ae8f-7710eb350a93", "comment": "Malware payload (AgentTesla)", "value": "02631003bc5440c2fe14719d0bb154eab65cd83c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413102, "uuid": "aadb58a1-cf50-42b3-b82c-1dfde9c7107d", "comment": "Malware payload (AgentTesla)", "value": "5ace012e992b3b283a72a6f32216e91979a524edd3f0ffebce85562a5cdb6a8280fb340e2f080faf35d76eaec96dc620", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413102, "uuid": "0bb763c1-104b-4e4a-8268-1b7c73c66663", "value": "T16225AE197755BF9EE22D0E75C4270E4883E991537276FE8B29D028E00A11716FF4FAE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413102, "uuid": "87f00ed5-26ce-4336-b223-1d3b4c05ee86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413102, "uuid": "13eb5af3-be75-49a0-ad8c-3bcd9364acaa", "value": "24576:ULTn/jv3rXb2eBOFh0NUBrKUnyWxS8G1Km:2Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413102, "uuid": "f05ec8e2-d8a2-495e-b6be-5cab9fb00b68", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413102, "uuid": "b7ffac84-a9d4-465c-b7ae-eee2ee1ccf77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413102, "uuid": "63913e1c-28dc-4b43-8828-e55ec8fa6e3d", "value": "RFQs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f54428e-25ea-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633444989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444989, "uuid": "6492da5a-d18a-413b-843e-2f67020a27db", "comment": "Malware payload (Vjw0rm)", "value": "13cbbf285a8353dea38b24e1e1472c29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444989, "uuid": "f5270d3d-6fb8-4101-9a9a-1cd37d0337b1", "comment": "Malware payload (Vjw0rm)", "value": "6ecf7599637e51186edb088b0b39b592676a6c61c5917ee5c58a64b2ffed0be7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444989, "uuid": "464fb7c6-8a19-4105-aa50-4ff1012c0bcd", "comment": "Malware payload (Vjw0rm)", "value": "d5f98537c95a00a6fbb9db349a1567fc2ac74cb9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444989, "uuid": "7c34fc1c-529c-49e7-8726-54507a0392b0", "comment": "Malware payload (Vjw0rm)", "value": "8bb0223e592eab0fc41ba3351596b348fa2fffeb7e73628805973fb01ff4651e4646b10fdd3ade1327ff177ee2d58014", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444989, "uuid": "6460b1f8-6619-4869-9591-76a1f21678e0", "value": "T11742C08EF4529EB1826250FF9DBFC507E9D64DF2D406ACEC04AAD01076A481E1762D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444989, "uuid": "89a2b16a-5dab-4e26-aa89-a2b79ec86cc8", "value": "384:QQkDQuBBGYqn3pjZVOlx2mqan8v4Hv6KDe:Q5DQuvJqnRmlx2mpn8AHyKDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633444989, "uuid": "3ee62f0b-c44d-4ae1-820b-c22e88e507ba", "value": 12737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633444989, "uuid": "fed1416d-6f69-405f-baca-10d151ac3743", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444989, "uuid": "f18b0c72-58bd-46b1-8749-453e38cc59d2", "value": "YUEOPInvoiceCopy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbdc166-25a7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633416019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416019, "uuid": "9d55735b-ac5a-406a-a259-b46750dc8e77", "comment": "Malware payload (AgentTesla)", "value": "fd62d3f4351800c3a7775d27ab045e55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416019, "uuid": "5f2083e1-e3c8-45bc-afbd-8cd41116a09b", "comment": "Malware payload (AgentTesla)", "value": "6f6dd95ff690085d12d9496334e98c600b7e3aa1bfe0e9fd54fd42b3107a5fd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416019, "uuid": "e475e859-8b87-422d-8705-b5794fbdaab7", "comment": "Malware payload (AgentTesla)", "value": "519a54a283fd56c9c65e8fc1c486e74ce719298e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416019, "uuid": "3f03132a-78f5-427a-9182-b58abb1ba4be", "comment": "Malware payload (AgentTesla)", "value": "2d48e2ba961c0691e2edfc5b40b9f11c198e815ef3ec0d1e925abc75407674c6d44d61b8533d15b19328df2009507737", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416019, "uuid": "1de7acdd-1238-4fb2-b398-159b3096bce9", "value": "T19074D0117ADD9030F0B282765424E562467EFE318E2B5FAB3BD95C8E5A744D0EF24B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416019, "uuid": "f2c08667-979f-4551-bec4-3d773adb42b1", "value": "337cc3ba01595b56bed66bb7d8f07a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416019, "uuid": "5dd80f84-f79e-42f6-86f2-cfdc892bf382", "value": "6144:s8Jdezi2YUK2FcUpi/lFiocRgmLZ/s/Bb1vQ8TbGFjtHj:s+om2wFUstLcRJwh5QkbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416019, "uuid": "b753f67c-cf7d-4d8f-ad14-28bbb03e06cf", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416019, "uuid": "5ba510b2-7b6f-4c36-8aac-c2529a01a9f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416019, "uuid": "c0ea5d59-22ac-4d5a-a280-cb60444ebc18", "value": "Purchase Order_CG10846482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0a7da3-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436963, "uuid": "3a3ecf6d-5509-4340-ab6f-fedf97333f53", "comment": "Malware payload (SnakeKeylogger)", "value": "c2cb8b1611a7878dbdd593b42db116a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436963, "uuid": "1e2d0c70-3cf7-4463-9cc6-b8b247c1d543", "comment": "Malware payload (SnakeKeylogger)", "value": "6fb723d20eb83b2f8f4a3412e5b540a07556388ef3fb0858e34532555e39a077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436963, "uuid": "c3b279f4-3015-46e4-8da1-7f9ca3232e54", "comment": "Malware payload (SnakeKeylogger)", "value": "9471797cb235c12608cc67cbf11a0bc36b43b18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436963, "uuid": "6b273ddf-f24d-49cf-9ce8-9830834b6d23", "comment": "Malware payload (SnakeKeylogger)", "value": "f6474b00d9e10ffa7825c66bfa00623e324528430bf2a9542fd7078115840316d7255c3cc2ce0314d9977dbcc947a2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436963, "uuid": "76453653-a6c7-4e98-b2c4-d98400ddc317", "value": "T145C19512A7E88726E0B247386DF3870177B4BA176A17CB4E75D0520EAD27B108D93BB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436963, "uuid": "a4daf208-2df4-43ae-8a0f-49e046682ff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436963, "uuid": "5cc089a1-3733-49ed-8aad-8ecf7b6bb310", "value": "96:Kefglw8+cn5E+NhbhilioEdCvMuTrMHzNt:vYFu+Nh1eMvSoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436963, "uuid": "a6527b5d-6e2d-49b4-9a74-47550a9f38cc", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436963, "uuid": "b166e203-9df0-4e39-85d8-b962ac62ece9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436963, "uuid": "495a76f9-f027-4468-b8f9-df6ae35d42ab", "value": "c2cb8b1611a7878dbdd593b42db116a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bb3c6d-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633413382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413382, "uuid": "f91588af-64ae-42af-a0bb-2e185295e734", "comment": "Malware payload (Formbook)", "value": "e29285288905ebb27d9e4443bcaa6638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413382, "uuid": "8b4032b0-0f5b-438f-9135-43d98e809af5", "comment": "Malware payload (Formbook)", "value": "7027a232f8327a532a1b37586cd42ea73ea0b9c37b1b22334484888f0b13b6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413382, "uuid": "2f1724e9-01bb-4453-9427-8698b6197c90", "comment": "Malware payload (Formbook)", "value": "3c656f9257b7630e47f57d1326bceafb7481ab29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413382, "uuid": "a83ea0c0-ce12-4495-b44c-6be3de3ba458", "comment": "Malware payload (Formbook)", "value": "02f72c5bb0957256248df03363f2a924f67ec075c4f9d4afb1bfec865155102fab2ba997d79b021bd1007308874525a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413382, "uuid": "09b3a880-ab62-41e1-960d-c6a3ddb50979", "value": "T1F5B4AE203DFB5119F1B3AFB95ED0B9869A6FB6233A17E41D145103864B23F81DD90B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413382, "uuid": "caa81446-68e5-45a8-b857-30fed3b536b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413382, "uuid": "79a0115a-cdd6-4eb0-a524-626b8fd98053", "value": "12288:tqk4DbF53e0IUFLe8OsbVPIBNpvv5Cq9HS2W3wI7GJFY:Gy8dPOX5CSy2WW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413382, "uuid": "3bee52fb-c458-4844-b412-2cd19747546b", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413382, "uuid": "fc59ba38-0511-4231-beb0-3bc7b3c3ba53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413382, "uuid": "c1782435-13a6-47a3-ae43-e4acd52ee329", "value": "Electronic Payment Remittance Document 09.13.21 VRF 65665011119889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ec3da4-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633454558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454558, "uuid": "ff35701d-524f-454a-a789-391bf9a4c023", "comment": "Malware payload (RedLineStealer)", "value": "a7595a0b8207dbf31c7c37b89fa2a05d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454558, "uuid": "2827c642-9a92-419e-8963-ab9bd417bc9b", "comment": "Malware payload (RedLineStealer)", "value": "70b67fb490756a02895239611d044a18ad4e719712611745fe5fd19c716e4e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454558, "uuid": "fd65faf2-9e80-40e9-8e38-c152a3b1aa52", "comment": "Malware payload (RedLineStealer)", "value": "9e4674b4324c785c223595516fd6984b06d9daa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454558, "uuid": "5921a632-c463-4929-a65d-580f30f48a37", "comment": "Malware payload (RedLineStealer)", "value": "adeb73d058d0eb5e752c10d57d56b34097a293055f6899a850d845c966afc03e254ca5d3f7e81806e8243195a1c20dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454558, "uuid": "e281af47-5112-46c6-91a2-c361d56cfd13", "value": "T19F348C0997C41B61EB7E7172E6D1306883F5C76926CFE31A5DC031FC2D66BA4B2062B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454558, "uuid": "8089a0d3-8c52-4fac-a567-d460da6da4da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454558, "uuid": "1436b55c-941c-4e07-9be8-18a7ed7273ca", "value": "3072:TYNVm89Ll/7af2wyAPcE4boPVc+R/uV09M5P9FAUQ/kVvu8QVuUFkVoBUkhtynm1:TU2ZnPcEJPVc+RWb50Uju8Q7a6K6ynm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454558, "uuid": "5d744b84-ec66-4ddf-bb68-9e78c27e977f", "value": 242912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454558, "uuid": "cc37066f-5855-4c67-97a8-648dfece417a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454558, "uuid": "308bf567-4078-4bec-a8da-358c0a573eef", "value": "a7595a0b8207dbf31c7c37b89fa2a05d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efaf90a-25c8-11ec-843c-42010a9c0014", "comment": "Malware payload (AvosLocker)", "timestamp": 1633430198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430198, "uuid": "7ce1489d-4525-4064-a3d1-2581cc012da1", "comment": "Malware payload (AvosLocker)", "value": "b76d1d3d2d40366569da67620cf78a87", "object_relation": "md5", "Tag": [ { "name": "AvosLocker", "colour": "#B6F2B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430198, "uuid": "bd4358a9-417c-4493-9274-1ce57b983414", "comment": "Malware payload (AvosLocker)", "value": "718810b8eeb682fc70df602d952c0c83e028c5a5bfa44c506756980caf2edebb", "object_relation": "sha256", "Tag": [ { "name": "AvosLocker", "colour": "#B6F2B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430198, "uuid": "ab248ee1-c5a6-4e4f-bf5b-2dac34ad550d", "comment": "Malware payload (AvosLocker)", "value": "ae23c0227afc973f11d6d08d898a6bb7516418e2", "object_relation": "sha1", "Tag": [ { "name": "AvosLocker", "colour": "#B6F2B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430198, "uuid": "513af367-1369-4c3c-b2bc-30d42d242654", "comment": "Malware payload (AvosLocker)", "value": "843bd51892784b86492d16c1010088ecb5da704f4107bf0e0be2b26cbe1dff1ffbb9aa8b71b17b63ef507bcfffdc3a3a", "object_relation": "sha3-384", "Tag": [ { "name": "AvosLocker", "colour": "#B6F2B9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430198, "uuid": "1d1b5cdf-0539-43b0-aaf6-89aad528cfdd", "value": "T1CC158C313646E077D82205B15D2DFAAB523EBD350B214EDFB3E82B2D5AB41C11B32A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430198, "uuid": "a2b52613-f4cd-42db-9e48-7defd01af896", "value": "7f1c4bda4f313aaeb5367011099c8e71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430198, "uuid": "fceb17ca-e71f-4ef5-8a59-a0cebfca1ea6", "value": "24576:SnkXEg1ZlhKG+WWZtCpDCE5Ie534SCeTpOl135HlI:SkXEg1ZlIzZtCpGE5j5oSHOlxdlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633430198, "uuid": "0e900af9-0ef7-4d74-909d-c376dd8c7c65", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633430198, "uuid": "c5632245-c41b-4ca8-bdd7-7c5e7e67fd4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430198, "uuid": "d6bb08a6-a03d-41df-a69b-f8843f573cde", "value": "718810b8eeb682fc70df602d952c0c83e028c5a5bfa44c506756980caf2edebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c131b418-25f3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633448939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448939, "uuid": "7e2eab0a-4c19-41f5-98e0-26f1488235c5", "comment": "Malware payload (TrickBot)", "value": "2e457b5226cd974845c906ef142c4a06", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448939, "uuid": "fa36a5d4-8868-4b72-945d-7eb0a621e404", "comment": "Malware payload (TrickBot)", "value": "71a5ee88580fb5ab41db8fe42ba2197cfaeed46ff40b4d8942ced0d5eda9d2b3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448939, "uuid": "7e2e4302-d686-4f3b-8fc2-6422b590a874", "comment": "Malware payload (TrickBot)", "value": "8dac363d62a5daf94ea55d58efea84415812e8b4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448939, "uuid": "04baf4ac-fa6d-4f0b-93ce-432e46cd688a", "comment": "Malware payload (TrickBot)", "value": "6fb918844d5a8c77d79523e642a06233ab69459ddd779acef89b860c4aa04f3b7851f91c7fd211515e19a09435f84abe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448939, "uuid": "547bff6f-9762-4ef3-bd9e-3d57b5724a88", "value": "T1C873B402A6179DCBD5DC50300CF6C3853169BE88BF884383726B7F1D6F7996A96D3286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448939, "uuid": "ab2795eb-d6dc-4421-81f3-bdcf593ae8b6", "value": "768:939WXjpqhPNeDEdFYr7cw1YHVtWTXnINmwwutQ0B9mbUmjFVX0UioTwlR4YB8mJ+:9YKQgmTX0rdqMjHFbJpytS9ozSF61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633448939, "uuid": "1b4c9c2e-5d8a-4dc5-bbd0-68025708799f", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633448939, "uuid": "77a70374-d1bd-4489-8b30-407732802d16", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448939, "uuid": "8312b3eb-61d7-4eb9-9ea9-97ad8be229ed", "value": "figures_010.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91718ba8-260a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633458737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458737, "uuid": "c44ccca4-c463-4ab4-855f-1c7a33e5a4be", "comment": "Malware payload (RaccoonStealer)", "value": "ee3c297afb88f45aa9892eae486ed255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458737, "uuid": "493e6596-9c40-4c5a-9bb3-71936d15d5ef", "comment": "Malware payload (RaccoonStealer)", "value": "71c8ba3bff2028ae1586c04850560d0d11711f166b4713604c65bb68db07e03a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458737, "uuid": "1651ecb0-1a9f-4ef5-9e1c-819c1a40c8ea", "comment": "Malware payload (RaccoonStealer)", "value": "9faa8720b100599098f982cce257aba3362aba8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633458737, "uuid": "f3c3c2b2-6a14-4d40-85ea-de38109ef2d0", "comment": "Malware payload (RaccoonStealer)", "value": "1377dac769f4bf1d6b395d579b74e0806fdcad3a4b48c5c6a74a41665eeb8f828f8f9d9fd43e990d2fb4df3bf4caa76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458737, "uuid": "cfc23c70-34ac-4f23-b892-dfc25535b061", "value": "T1B5B4F10177E0C035F4FB22F648BA83B9A53E7A716B2591CF52C126DA9A346E4ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458737, "uuid": "84efce27-8249-4b01-9b5b-0f99a2c1bbb6", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458737, "uuid": "ea89883d-3ee9-4921-872d-69c4dae2a8c1", "value": "12288:/0El6dKXFdDOk1vuJUN+Moez0/8SO3f91KS:X6dQdB/Y/8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633458737, "uuid": "e67bb912-9005-4535-96ff-df81f7ab9ba6", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633458737, "uuid": "4872d293-d06c-4a1d-a831-613012b49720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633458737, "uuid": "f381c9e2-9cb7-42e1-ac26-4d5442415b9b", "value": "ee3c297afb88f45aa9892eae486ed255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d6961a-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436979, "uuid": "2844ca40-d93c-43cb-b726-2b969cd9436f", "comment": "Malware payload (SnakeKeylogger)", "value": "c92b9d0d2784b7754169c883ba732fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436979, "uuid": "12151837-1023-4b34-a6f3-59320a7faab1", "comment": "Malware payload (SnakeKeylogger)", "value": "721619eab75e14ef088619a6c98e2e62e5690238e12579b313f7f08ffae8929f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436979, "uuid": "b41b20f1-b3e4-4871-8208-4d0b2a820177", "comment": "Malware payload (SnakeKeylogger)", "value": "978612e9135b381c55b506b00af6d870e811a7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436979, "uuid": "79f08155-5eb8-4189-a995-ba3d6adf9b89", "comment": "Malware payload (SnakeKeylogger)", "value": "75057ef648cc0a74389d56c6bd2aa430fa86153d99f086d133306060e609daad9877ba752199f67830e7ad855beb8ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436979, "uuid": "250f25c7-fb3b-474a-aa1f-eff9bd74a65e", "value": "T18364232699C588E7E6E794F04F7A66A4FF7D454960032E138B942E3F3D620436B2C9D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436979, "uuid": "9ec0fe8d-d2cc-4922-beec-ba190c736e8e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436979, "uuid": "e2c7fd4f-e509-4717-bcf2-59b47a5321be", "value": "6144:b8LxBBXsFuOWi4FmraPRkF2LZYxGObuxwkOR6WwMqz4vMYteNSeikPH:ysHLumoR6G6GObDkOLpO4vrkEGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436979, "uuid": "31592830-f387-43cf-9c35-29de02edca3d", "value": 332344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436979, "uuid": "65c73e8d-9c3b-4e57-badb-bcdea28a7101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436979, "uuid": "1c283e53-700e-47c9-a493-1bb3910956d1", "value": "c92b9d0d2784b7754169c883ba732fa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c3bc7d-2603-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633455525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455525, "uuid": "d342e200-3569-4dbb-b89a-55bfae11fa8f", "comment": "Malware payload (TrickBot)", "value": "c2c1ba4964dd5ed582a2a2d61b997ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot159", "colour": "#73D437", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455525, "uuid": "99fbfc71-e7ef-45e8-a4fe-3672b85d29ce", "comment": "Malware payload (TrickBot)", "value": "728aff0d54df55bd4ed10a1c02c165e86310503cf82bd4c2d6b4b2a0a383dabd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot159", "colour": "#73D437", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455525, "uuid": "994b930f-5db1-4f6a-a408-7dd93524e7aa", "comment": "Malware payload (TrickBot)", "value": "46cc4c1c465ece91f3e4845ae6848feabb3ff693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot159", "colour": "#73D437", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455525, "uuid": "15391851-930a-4306-8592-592f67989333", "comment": "Malware payload (TrickBot)", "value": "fcaa07ba65895c128c7d13f1fe65b0f196f9b9cc0daedc06df73dc9ba9f77310da944c3fbd1f6a7c73e4278222ee1655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot159", "colour": "#73D437", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455525, "uuid": "c9e20177-3e06-46d0-8516-bf64bb32d6c9", "value": "T165F4BD0631C0D07AD5E221F1CED1EB295AF99E928B290FCB7B90F91E6E366C04437756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455525, "uuid": "5a16ac0f-b292-49c3-b506-068a6ed53ef1", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455525, "uuid": "8ed518ac-d3b1-460e-a0f2-42f0b2ba59dc", "value": "12288:dBx+M4F6CM2pEbihXZGrVOrtz0rAK97lF/ACLy/Yw:dn4gCM2GMX1ZK97H4CLyQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633455525, "uuid": "60c95f71-03a1-497f-8e1b-c1737824d0df", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633455525, "uuid": "b59695b8-2bc8-41da-9b5f-8f83428f2739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455525, "uuid": "850573cf-c65e-496a-aa8d-0a97a2086fec", "value": "c2c1ba4964dd5ed582a2a2d61b997ae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae532595-25a4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633414977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414977, "uuid": "e88c25f1-dcf1-415b-80fe-12944e1e06f0", "comment": "Malware payload (Formbook)", "value": "a3bcd016e3501122fc12d577ca179d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414977, "uuid": "2740284f-b241-4d44-b3ae-afc8c88207fe", "comment": "Malware payload (Formbook)", "value": "73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414977, "uuid": "0a67287a-0759-492b-a848-1f46d127e648", "comment": "Malware payload (Formbook)", "value": "e37addf025193afe54cb829d5c25284ee33e00e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414977, "uuid": "68dddb11-10a4-4acf-8e6d-9661453ea1ce", "comment": "Malware payload (Formbook)", "value": "dca02934e200823d06492db4b6e42221c1cd0ab28e301b416d894cda1aed45cb5048bd2f852e84144c1743874b60d689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414977, "uuid": "3b1b744e-7b64-4569-be39-e5c3d53ed0ed", "value": "T17DF4C064B747DA17CE7547F028EDA700133AAF211649C32E7849BABC1E737B4164CADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414977, "uuid": "15ef341f-db35-4784-a725-7eed404a15d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414977, "uuid": "87d6a2aa-2044-45f2-9653-f7269c9cb1b0", "value": "12288:jooae8iXo+8m0p3Myfjf+A5mMiHbKLJlV1:jlaFiXonpcyiYOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414977, "uuid": "0077a45b-8fb0-4508-85c0-cac1426f7e47", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414977, "uuid": "7ba2fc4f-a51a-4692-8726-576061b982bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414977, "uuid": "bcfd6e4a-fdaf-4158-a032-30c929894ad4", "value": "investigaci\u00a2n-URGENTE GRUPO DANI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454ff1ea-25c6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633429403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429403, "uuid": "5eeb3769-547e-4d6d-abe2-50cb50a3efe4", "comment": "Malware payload (Loki)", "value": "ef1c2cef13b8996a4ec493c7a958e274", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429403, "uuid": "3d9c84d5-5d72-4229-b2f4-ad661743da0d", "comment": "Malware payload (Loki)", "value": "745f4c8779d5d06a11961abfe988f02954f4d4484bd45b625a07773fc19dabe6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429403, "uuid": "b578c5ff-3e7c-4389-b81f-306a1f9c3b4e", "comment": "Malware payload (Loki)", "value": "0755c442d70d0029bcfd7d37042334259611dc77", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429403, "uuid": "dd031a9b-f4c5-4097-82ef-063f56fd662e", "comment": "Malware payload (Loki)", "value": "54b8631eeacb3de9180ebabea23f772429b6a5a2daa8c324c455af90e42d3c3b4ea5253683793a7f473816e178270975", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429403, "uuid": "7375cf95-dd7d-48c3-a6ee-e412125e1b57", "value": "T1F154236597E91CE7C68A2DA23C9A88C95F4EACF43484235C07C279FFD4738A02A56D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429403, "uuid": "cc344600-9cad-48a2-9abe-574103ce6750", "value": "6144:Lm7K0CzAF/z72YlzXNcOcqdWL7C9grClWG9P7pttEH:Lm20qAJ7plrNcDqdWL7C9+ClWG9P77i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633429403, "uuid": "1ba70c7c-7c4a-4328-93d7-941165bb1a5f", "value": 288740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633429403, "uuid": "a7378dc3-2421-4da3-bfd8-4db1c371e208", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429403, "uuid": "f8ea0de7-e4bf-4382-aed2-856d1a949211", "value": "angebotsanfrage.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0584efb7-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412116, "uuid": "34606e46-a0a7-4611-9ac2-971b3e252361", "comment": "Malware payload (Gafgyt)", "value": "0a2c02e5094f05c23e6e8ceadf324aac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412116, "uuid": "04a02a8c-5ac6-4cdb-8bef-6c2e52af380b", "comment": "Malware payload (Gafgyt)", "value": "748622f0246a436aaaf919e2e22b6b476ccab79882b13823518076d8430e7996", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412116, "uuid": "fefcc1a5-4fed-4a03-87db-b377dfa9376c", "comment": "Malware payload (Gafgyt)", "value": "b7cc0f463e6da111a574559c48773c863c9fd911", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412116, "uuid": "4fd7441c-a8eb-44fc-89ee-afb91789db1f", "comment": "Malware payload (Gafgyt)", "value": "277a4607039b0d280554dd9b11b18f07b373d759637b9bbf9106a1451e9d4a7b2348f08a66f7401398e7e9ffc9bda003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412116, "uuid": "feae42e8-9408-4663-9ac7-e6918e717170", "value": "T12AB3962A7E21EBFEE168863107F35F70879521A236A19385F26CDB185E7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412116, "uuid": "185b193d-03d2-40bc-9a0d-fc777e441e26", "value": "1536:Ewf7jO1TUGquXg8heYbyy2rK28IWbQZYeJ4moGJaUCOAbqtFSUmkixFxfC7cgjQ:GeIbQZqhuEHbqaUmkixFxfKcgjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412116, "uuid": "276bb0ac-46ac-4dc1-9d63-5e75e0673dbc", "value": 117457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412116, "uuid": "24263c3e-af67-4ee0-b58d-fcdbb7cc5383", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412116, "uuid": "f7fa440d-faf9-4e6f-be58-995a3607b668", "value": "0a2c02e5094f05c23e6e8ceadf324aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3381db8b-25e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633443117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443117, "uuid": "a4752369-8417-425f-ad6d-4eecd6ab67c5", "comment": "Malware payload (Formbook)", "value": "3a3fd7a74a59f1b5e23164d1a7c6eacd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443117, "uuid": "9efaba98-915d-47c0-a9d2-a0d5680d62c8", "comment": "Malware payload (Formbook)", "value": "758acf61b0f5ffe96a2ea2b6a946e32699e0e326fcc4f58596addb7c1784115c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443117, "uuid": "a3bf6e80-ff4c-4728-bb7a-3b89f25d8765", "comment": "Malware payload (Formbook)", "value": "6fa4cb57edd9737976f1a3285cfa566f6cfa060f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443117, "uuid": "f7c29e9b-bec2-40e4-ac56-c43eb4d307bf", "comment": "Malware payload (Formbook)", "value": "08b1a76a1daa71fad6945c1f1cf0bac14552973b7b1dd37df73901eafae84af0593946df1ff4acd8ae6a408fe81a942f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443117, "uuid": "c790a74c-9605-4b4d-8e3d-5fb4a511a7f4", "value": "T196A4CFA833AF6B45ED348FF4151CA19257FA6C371076D3690ED1B0EE2E22BB04A51B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443117, "uuid": "187faab5-81d9-4ea5-8223-f1ffbc688129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443117, "uuid": "d16efdb3-c470-4260-9fa8-46d7dcbd9040", "value": "6144:FDu2qHCdnhUQ+3HwOcc0WegeDu0PVLaxLxe0Xwo7h24wXO4+XmJeEnN6P/a/nj:TVocc0Wegd0ULwtpJVJbN6Xa/nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443117, "uuid": "b1e6e2b9-1b68-4000-b421-fc1fd1e65f10", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443117, "uuid": "e5f7e907-a268-456d-b368-965141508e06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443117, "uuid": "bf815e22-bf7e-426d-b23b-9495ebfa626f", "value": "3a3fd7a74a59f1b5e23164d1a7c6eacd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2129acf3-25db-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633438362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438362, "uuid": "68234c1c-3e29-4475-a10d-78339a9a88ee", "comment": "Malware payload (AsyncRAT)", "value": "734e8374a723602da53a08dd7a2d3d65", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438362, "uuid": "772a893f-f69e-42ce-afcb-e8f7eccd1454", "comment": "Malware payload (AsyncRAT)", "value": "760e61d036b1675d470e403a6319fbdc6fd360fc1d204677adfdd11b9b234b31", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438362, "uuid": "7bcc71d4-c3c3-4955-9d46-261729c5e28b", "comment": "Malware payload (AsyncRAT)", "value": "c9021ee2ba0461fa90a22ef75aa5d564dba8c8ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438362, "uuid": "c5fea40c-3342-413b-a468-51319a53b405", "comment": "Malware payload (AsyncRAT)", "value": "8627a14ab0fdd2467f4f263ba838a7a39a20fe8e3b8e97c897568817808ccea3c5aa87e5ba9e135670fe6869a7fb0aa9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438362, "uuid": "3701250c-1acb-43f1-9a7d-8ea120d998e3", "value": "T12815F1A6B717848AC8459772DCB37B2007669FA95CD7C70A71A63B2FA17F3137801782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438362, "uuid": "f86617fe-4f40-4014-822e-ca6b267cd4e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438362, "uuid": "31420c24-5d1b-4934-8fc3-1374554e5029", "value": "12288:IXJ7sEQVD83oOLtS3zWejFvgJL4f95WKr3+pGaaF7umVyPvkSdvgKSrzKvaM4AzT:eSxk1tMhvgY90NpgF6BsAcEaUzdQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633438362, "uuid": "bb5633a6-1fe7-4053-9386-70342ad013d8", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633438362, "uuid": "fcf80a89-de3c-475c-9e29-af3af49b42e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438362, "uuid": "bdb56056-bf3d-4f90-bd29-3c8a79e16164", "value": "EUR31000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7691c74-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633437326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437326, "uuid": "894fa3ab-9f91-4efb-9432-6439564e48ad", "comment": "Malware payload (Formbook)", "value": "d1ecc3d1e49fda8da3c742f2c0d17d18", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437326, "uuid": "d94f7625-60c7-45d0-8cee-8515631d2351", "comment": "Malware payload (Formbook)", "value": "764bbedbb0e2b100e0f83d5ac28afd0903f859c3efd95b6f5e56e59ff98411e1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437326, "uuid": "73a8d6d4-01ef-4648-a3a3-4e201e6b797a", "comment": "Malware payload (Formbook)", "value": "0a9389ab991fbc18ded407ea165bfbd0a3d87ad2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437326, "uuid": "951dfee8-6be7-4e16-b151-79cbc29a8cfb", "comment": "Malware payload (Formbook)", "value": "755c5a9e15f33afd2b5603d51c8fdbb46da7a122640f32288cae2fa01aaeb68f1150b74454027132070db1a2815e60c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437326, "uuid": "f2c9ea97-948e-4f0c-bfaa-99212a9e5ef3", "value": "T1586423A4714BE323F19395388E1183E1CC6DEED8DF539B917961BBC95AB87C02C9C642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437326, "uuid": "c03ff036-00e7-4c68-b5c7-ea43863f5fee", "value": "6144:YkuWDbKt6eqx1J2Z28xKWGGfd1i8dOjbQ4Zs5EOJJgZlpCRZ4Iw:lIUeqUDHBPieOjbQ4e+EkvoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437326, "uuid": "a6f693f1-d0ff-4b31-90a6-0dba8aacf89c", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437326, "uuid": "e0b0f0c7-66f8-46a5-9bf1-e3e59dcc0239", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437326, "uuid": "752b1903-ec06-4bb1-b127-9b4961105724", "value": "Tender_Specification_Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a69fc0-25b5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633422081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422081, "uuid": "12f305d1-0f84-42e0-a794-4b40e90d0c03", "comment": "Malware payload (Loki)", "value": "054b8ad69f868fa172c8c46c735b5dbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422081, "uuid": "41f8bfcb-5704-489f-a242-47433b00b11b", "comment": "Malware payload (Loki)", "value": "765994fdc9901ad3d0ca36ee7d5b083d0877093d26d12f9699e131ae2cf87bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422081, "uuid": "107206c3-a9e0-4f24-aa58-128aba01766e", "comment": "Malware payload (Loki)", "value": "cff85059a466909dd3fa79de27fd1c40b69f5c6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422081, "uuid": "92fd0ffe-9b8a-47be-b889-d1b8168f99c6", "comment": "Malware payload (Loki)", "value": "9ab1ece6ae7209bb289577d505a70141be2329d6705e50a0e9b3860f607d82c04a8007a46e6f2d48f8159bcd7773afce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422081, "uuid": "2762f9b9-414c-42f7-aa53-e081b63155c2", "value": "T13684AEA423AF6F45DE358FF4141CA19253F6BC3B1569D3690DD5B0EE2922BB00B90B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422081, "uuid": "d8619842-275d-4de0-8a65-8466e090d82f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422081, "uuid": "1022d65f-6bc4-4c28-942f-06bedd322b94", "value": "6144:U/JoEbacSnhAQ+3HwOcc0WuXN5gvgDXx3CWdVwK6ecIMgGq9ltXTM1r4/EpjA3:bpJocc0WoUIDXzZ63TMtc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422081, "uuid": "3f27f159-5033-472c-82d4-300de7b22405", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422081, "uuid": "91246ecf-54a5-4517-9ce3-0e767b820aeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422081, "uuid": "1cb286f4-d186-449d-8f81-3f168a00529b", "value": "054b8ad69f868fa172c8c46c735b5dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6b38b5-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633416527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416527, "uuid": "ab01877b-ac1c-43ec-a360-640e77d5da73", "comment": "Malware payload (Metamorfo)", "value": "ac210a9b84df20647ba433e9a1469725", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416527, "uuid": "a462f168-aeb1-4b72-b81e-a3ff64bd03b8", "comment": "Malware payload (Metamorfo)", "value": "776134c134534d0dc096adc95eff7bf3e9f0a029436dd3e7e50438defe647762", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416527, "uuid": "8ff6776e-669e-45fe-829d-f0c996fc5885", "comment": "Malware payload (Metamorfo)", "value": "371087ff850034acdc3a3f4636b5fda8b32aeb82", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416527, "uuid": "20538266-09e7-4406-818a-6daee93bf08d", "comment": "Malware payload (Metamorfo)", "value": "5845fcd27a4032e73def0d0a5701cbc4875eac12c469828335026df91210aad021aba5f2bd3693fea260fc5f93d37815", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416527, "uuid": "b1df843a-185b-4d61-993a-240e3ecf0906", "value": "T1AA41E30599D6C325F2B3CAFE3EF653C66B26B8C3B9D2CF5D4080568914710D0B8A4D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416527, "uuid": "17916326-4254-4657-9600-cf8cc8563287", "value": "24:8+JUHRlVo5kcbA+PzJYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYwf+/P+7x41cV3Z/:8+uH+M+LxA11cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416527, "uuid": "4d49d36d-7723-4b04-a1c7-1bf06b0e570d", "value": 2050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416527, "uuid": "1ba8df97-0e6a-4385-8996-0eade7ca728e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416527, "uuid": "30ce4076-d3cc-407d-8ed2-3f3aa801bb4e", "value": "BoIeto 0410.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4052b1-25c5-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633429148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429148, "uuid": "379abee9-4dd1-413a-bb52-3bb4975069a2", "comment": "Malware payload (CoinMiner)", "value": "99f51633e0f6419c6310a9e08d3626a1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429148, "uuid": "9350c69a-250c-4caa-966d-49af5dc27eef", "comment": "Malware payload (CoinMiner)", "value": "77e702d254b785a06bcf595edf09601d6cffc172cf019646145c7631091e20a9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429148, "uuid": "9447e188-ea72-49be-8eef-cdedede32532", "comment": "Malware payload (CoinMiner)", "value": "935ad4c746965e5a92a7d82d8c0b96cffc4fde08", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429148, "uuid": "48a0bbb4-294e-4b0f-8041-f419657afe7c", "comment": "Malware payload (CoinMiner)", "value": "d101cd6d79b90703ac7ee7b3892c70eb36f12519340cb10f0f1d3ee86d1d92c21515ba9e5140c589cdb2461d262b29e5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429148, "uuid": "f84f76aa-399a-4219-9209-f45e9b0dde2c", "value": "T1EA6623F97288376CC01FCC749833E945A2B5520E5BE8966E78CFB7C03BAB610D646B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429148, "uuid": "c62de131-ea3c-41a8-9302-9ec909a0698b", "value": "9a9e6c9ce6105ad0da2a6340043f0b25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429148, "uuid": "a27e4cad-4eda-49c5-b025-e379b9a77489", "value": "196608:vg+4e5gFmXm5lxO8nTg0S4Two7zex35w:vg+FWLOpzqzeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633429148, "uuid": "d8ce5aaf-cc43-41ba-9deb-43579810d5da", "value": 6520832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633429148, "uuid": "c90c58aa-1f44-42fd-9ca6-4a6c37179017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429148, "uuid": "76ed2b4a-4d71-4dfe-815d-131458f97be8", "value": "99f51633e0f6419c6310a9e08d3626a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58289f3-2621-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633468756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468756, "uuid": "d43a5860-8f4e-4e6c-ae43-5211e31dbf1f", "comment": "Malware payload", "value": "b421ea192e2e74c856f2655192262b17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468756, "uuid": "afc3dd85-6479-4bcb-92e8-ef2206758166", "comment": "Malware payload", "value": "782503b418bb1f3ce1cde146ffd7ed73678485939235c9664509c39ed03f3e73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468756, "uuid": "934abf07-706a-4d94-86af-49d4b00ac16c", "comment": "Malware payload", "value": "56e69fd45d13677b7877d84d12c5ca08df41a2f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468756, "uuid": "3540792b-82ee-4fa9-b234-61356edee8af", "comment": "Malware payload", "value": "9942ab0734704a04b44d2ff3d07faf8c6c180f2346b0d67a78072330d80e269fc92172be44461e77c0f4513eff6b32e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468756, "uuid": "091a1df0-d965-4501-9c85-2e06d7a826df", "value": "T184B4BEAD321476EFCC27CA768A951D28AA50B077432BA203942751DDDD0D9C7EF622F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468756, "uuid": "f505f98a-767b-41c4-a14f-bdb911bf7515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468756, "uuid": "41443391-4c65-409b-85d4-65a40d9dd865", "value": "12288:75So4xEK29dp4yNB1KBNY+itThIf8ktvQvd6oS15gK+DGdFD9:NpKBW74yL1KXxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633468756, "uuid": "2b55162c-11a5-49ee-9b8c-50820deec8c3", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633468756, "uuid": "d4b2430c-6a8c-4237-b358-71ef4b4b5d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468756, "uuid": "e2d41312-5235-4b4b-87b9-0b843d0377e1", "value": "Pl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1842553e-25ac-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633418161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418161, "uuid": "4126aad6-0d4f-4fba-923f-db2e39aefbdd", "comment": "Malware payload (TrickBot)", "value": "d6e22dcd5f81671da7c4a1191d480c63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418161, "uuid": "14623f9a-2e11-4858-ab9f-a09a656eeede", "comment": "Malware payload (TrickBot)", "value": "78467352d7034224d72a7846e1ce2102d2b7e31aa85d72383694c8bc51937f20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418161, "uuid": "7125a781-5b07-4b8a-b76e-15abbf5f6d20", "comment": "Malware payload (TrickBot)", "value": "17f6454a34cf6923c573693f614b214c14b3b03a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418161, "uuid": "3923ff02-08e9-45a8-b084-2b29771f9b19", "comment": "Malware payload (TrickBot)", "value": "624c342c6352a27972281e57a4a1a3f7e2c6864778ee49b5db3656c51e540cef21b61fa66324b16b3979704d61c97a2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418161, "uuid": "7f034221-109f-461a-b469-a5845407ba53", "value": "T1BBB4F10277D584B3DA62643209EAA77AB774BD554A32CF87A354FF0CDC31240993B36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418161, "uuid": "a128d747-60b6-4c49-8223-4b5726f80ec3", "value": "e38afb91bac491f7825e4d9386ac015b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418161, "uuid": "689c9d78-c2a6-4846-80a5-b387b0ae963b", "value": "12288:J1YWEJFGqCu7+K+1A8uKQfL/g8g54yXsJ/20V/YnOcy:J1YWEJFGqd7+ubgNtsJ/5i5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418161, "uuid": "5afe1af2-e443-4c3e-ac3c-e824a8e78034", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418161, "uuid": "bf2b3eb7-8155-404b-89a1-81f59e2c2e56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418161, "uuid": "78872758-7d3f-46dd-adf0-b9a256463eff", "value": "d6e22dcd5f81671da7c4a1191d480c63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd16e7e-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633454540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454540, "uuid": "ebae7334-2bad-4afb-9ffe-c30d8e12c6a3", "comment": "Malware payload (TrickBot)", "value": "bc1fabbc7e42df40088602c2d317a073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454540, "uuid": "6b32616e-44fd-4842-9a39-fc78acbcc5ea", "comment": "Malware payload (TrickBot)", "value": "790769e6e3eb9d2d5d70b03c8d5e0728e954a2bcdd3625b87fd3366b961b90a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454540, "uuid": "7dfd276b-f90e-4e64-b1a3-d4c4a6091b00", "comment": "Malware payload (TrickBot)", "value": "aaec414cd14afb803b63477819cc91f1119375dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454540, "uuid": "3ccb7036-1ff9-4330-9b07-4471b18ac593", "comment": "Malware payload (TrickBot)", "value": "020347d37a79877c31f2f88132219a1e801f9b61f108fcdd212bf12f8ff93f8d8175c16f55c995fe42f979318efdb1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454540, "uuid": "00d0556e-f83b-4d3d-bd95-b92e96a84109", "value": "T1DBF4BD0631C0D07AD5E221F1CED1EB295AF99E928B290FCB7B90F91E6E366C04437756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454540, "uuid": "28858c30-96cc-48c6-b044-719b7015a65b", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454540, "uuid": "80efd812-7f23-4524-97f5-870d95656a1e", "value": "12288:dBx+M4F6CM2pEbihXZGrVTrtz0rAK97lF/ACLy/Yw:dn4gCM2GMXAZK97H4CLyQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454540, "uuid": "4067b49c-0b46-4087-8a11-904219a2feb9", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454540, "uuid": "677fc98b-51d8-4fb0-9350-9b7c60080b2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454540, "uuid": "2343ef9f-c135-45e6-851d-38cbba2ea25c", "value": "bc1fabbc7e42df40088602c2d317a073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f2f164-25a3-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633414479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414479, "uuid": "47188500-f264-4eea-8549-f6a2dd69b0d4", "comment": "Malware payload (Metamorfo)", "value": "3e8215eebfef0c06d6cd2bdd67aeeb20", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414479, "uuid": "823984c4-b0d0-476e-948e-62619915f01e", "comment": "Malware payload (Metamorfo)", "value": "790909ebcaccbec6c7af481f9e9b6789a58b2ddf3a2de58da4b9b152d852ee07", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414479, "uuid": "3ec82028-bfb9-46e8-aa87-4d31489d2356", "comment": "Malware payload (Metamorfo)", "value": "ce54174f6aff0cdd4899f3d49efb142f718ed832", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414479, "uuid": "5d0977f4-55b6-4884-85cc-64f660ad2678", "comment": "Malware payload (Metamorfo)", "value": "5283d35400c5d0b5797da202be97ba768320acf67081779e95a88e52b08a2807d9adf79970568aa3e6152067054190a3", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414479, "uuid": "ebb48195-07ee-4f7a-9c74-2948e4447ca8", "value": "T1BA447D06B3D5437AE4DB07325B8F93628A72EC788673412B1249760E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414479, "uuid": "389b61d7-4629-4bc9-9c61-7b3e09596781", "value": "3072:emMj5J9B3DaY/Ahwgz88ereWn/7w05g04McB3RUN46ILJ9+ZB5yOanYc:emc3DaY/A88er1nzTBrLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414479, "uuid": "a7c15738-bbd9-46e6-a99b-d2d235ecfc21", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414479, "uuid": "41fbffbd-9c66-49f4-9dbe-c7048d53c74b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414479, "uuid": "0e4f657f-a3c6-4498-869c-d31beffd49aa", "value": "3e8215eebfef0c06d6cd2bdd67aeeb20.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b7e552-25ad-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633418766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418766, "uuid": "b2bcaed7-9eeb-4f13-b039-1f2c92389e4b", "comment": "Malware payload (AsyncRAT)", "value": "c55c7e886a741c35689b0c6792a7e1d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418766, "uuid": "892b14c8-0a63-4a83-9a9f-77e2a3dd2670", "comment": "Malware payload (AsyncRAT)", "value": "798803a6073a22278e939e32c5e1d6eac621ff4dbce53051d6bb488f352d80fd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418766, "uuid": "11a84969-e847-4e99-886e-c612f8bdbdec", "comment": "Malware payload (AsyncRAT)", "value": "f249389f409b831ea00c1eacdd301b47fca43c8c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418766, "uuid": "23f0857f-80ea-4be0-9023-72acfa32c06d", "comment": "Malware payload (AsyncRAT)", "value": "47502f4bd4683149e8b267295a2274d1d38e869c82ab205c2dc0e4899b2a2eb8ab59e075f6e3957fd0350c882fddb009", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418766, "uuid": "60193092-c7d9-42cb-b1b4-2fbcb1642ba7", "value": "T192334B003BE9812BF2BE5F7459F22245857AF2677703D64E2CC441D71A23FC69A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418766, "uuid": "712f966d-3de7-47b4-a6eb-fd5b759d1542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418766, "uuid": "447fa478-6a99-4102-9794-eed33812f53f", "value": "1536:oui3NTdBR2jwOQACN2b0LvoA6E0dGkc6x:ouidTdBR2jwkC0b00j4Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418766, "uuid": "dddcdb98-b6e8-4528-ae74-61c3defa53ac", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418766, "uuid": "86fcb741-6e27-40d1-bf01-c20a1abd072b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418766, "uuid": "df0e79db-a347-4593-a30d-675d54e4c12f", "value": "c55c7e886a741c35689b0c6792a7e1d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f326604-25e4-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1633442197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442197, "uuid": "77b5985c-6908-44b1-a66f-485e792b3df5", "comment": "Malware payload (DarkComet)", "value": "70370dcb2ad41fb78d0439236518c6c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442197, "uuid": "b35e4e3a-b751-4ee0-bda4-4694d06bdd20", "comment": "Malware payload (DarkComet)", "value": "79ad6abe442b9e7120ca8b44d9c5f4a187d67d27d25d7ce2be64f011431633a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442197, "uuid": "3a62b494-ee77-4d46-bbdf-aa28a05068d9", "comment": "Malware payload (DarkComet)", "value": "35d86808ab71511ca0aaf5268dad6644718d3eb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442197, "uuid": "15b31fcf-2411-4d16-a349-24d6e942b7ec", "comment": "Malware payload (DarkComet)", "value": "3001f76635bd713818a29df17d7527f775193c2e77c534100e80eaf8481f87c4a560fd51ed61456d05f25a399bc25d6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442197, "uuid": "63b3479e-122c-4b8e-a428-02dfa258af5f", "value": "T187C4235A33C9EDF8DD7AC43B31952F84DB2AB575E480F8334202D69DCA206B183FA456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442197, "uuid": "d0d22aca-0d57-44a0-9248-aa4f0e10fff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442197, "uuid": "aaa8426e-04a0-4ab5-84db-a96666e44b7f", "value": "12288:7Wp/ihlQi9C1wi5Qvsns2EjiN8AyjeeAH7zP36K/P:itQHi5saMm8wSKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442197, "uuid": "a93af142-0994-46bf-8f32-588699ba7a2d", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442197, "uuid": "e2e87608-ef44-443f-88da-95a4e3aeeac9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442197, "uuid": "14dcd56e-d4c4-4da8-91b7-6c1afe0e44cd", "value": "70370dcb2ad41fb78d0439236518c6c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64966a14-25dc-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633438905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438905, "uuid": "480642ac-f9d6-4b35-b0a7-3308a1214707", "comment": "Malware payload (AsyncRAT)", "value": "80b1013a3e673f946936e221655d1eb8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438905, "uuid": "edaaeb01-2795-464d-8ff1-c0c2b8bdb8da", "comment": "Malware payload (AsyncRAT)", "value": "79b2feea1d26ddca465aaa01a7dbb7dd35aa2f111e09766a2eca88b35df1c747", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438905, "uuid": "7af49eae-9a11-4c61-b294-d933ac11dc68", "comment": "Malware payload (AsyncRAT)", "value": "cec7c017f93cb8eca302c5b9013304965a2a2a8f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438905, "uuid": "d3d179b3-29d4-4db2-8bd6-57507e154888", "comment": "Malware payload (AsyncRAT)", "value": "2bd0397f148431c387ad7fd703c9931779925468a6e43f04947d297910464de5ed8734c7b9d5578e377a9aa079382abf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438905, "uuid": "fc720ef5-f369-4f02-8504-32b180c38955", "value": "T1CE45121B265B511AC8206B75DEA3BB455B618FA7E4A3C692DE36331DC07E3367C0C386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438905, "uuid": "cb805306-b570-442d-9684-b845b83de5d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438905, "uuid": "46ec8439-8faa-459b-85fd-81149620c6ca", "value": "24576:JDNvpbdp9/2f3Ky5Q41ORbwAHV+WWT86fDsU27fORAF7vwn:VvpTeywnQbwTtfi7uO7wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633438905, "uuid": "8c5772ec-7dc6-4177-a112-c574f2c6530e", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633438905, "uuid": "d7a17794-ab0a-4fa8-8478-d5e1b2079229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438905, "uuid": "73daa49d-4e54-4498-b4dc-3a31119db35d", "value": "80b1013a3e673f946936e221655d1eb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359b05b2-25db-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633438396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438396, "uuid": "9ed264f8-7e56-4af4-b191-506f0297e668", "comment": "Malware payload (AgentTesla)", "value": "53399e0fd781cfd3bec2cef355ae4976", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438396, "uuid": "c0160d7f-11c5-4485-b759-4d1a3f28f399", "comment": "Malware payload (AgentTesla)", "value": "79e7e8154282b03fdadf50ee995f7124563bde56c8611438953c454b7b059764", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438396, "uuid": "fc4223bd-fc9b-49b6-ba89-b291dd2d2619", "comment": "Malware payload (AgentTesla)", "value": "1013d00af218bbacea9fb38d252fb218620452cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438396, "uuid": "230cb1b6-8c8f-4a20-bd0c-0ff29a3ebcdd", "comment": "Malware payload (AgentTesla)", "value": "36538a82c23529f89ea6a544d89af45cf202291100fb48999ae48807e71cce9021fe8261971025402e5b42acf8239a79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438396, "uuid": "a916842d-50be-4e1a-b439-54385a5f8be3", "value": "T1AEF4F6AC321375DECD67CD768AAC2C60AB20687B530BD213901725EC9A1DAA7DF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438396, "uuid": "87d606f3-4060-47f4-8ea0-721940812964", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438396, "uuid": "73c5de51-d259-4f4b-a78a-02558a7b01ec", "value": "12288:gtwRmyzpUalvtWeA3oc0WCvTxfpoaUsIu4kdPiFH3enyDBdD7T+WOwBVc55QluT1:gwRmapnAeXc0WCLDf31piFH3eejDGWOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633438396, "uuid": "07686ab6-c8b9-41e9-930b-c7dc2a0fcdbf", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633438396, "uuid": "393b6966-9bcb-4d5d-a42d-3976664328f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438396, "uuid": "6fcd3243-80d9-4110-92ea-7a1f82c991ce", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f84735a-260c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633459378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459378, "uuid": "2f23605f-83d3-4084-a6bb-1e42d8c0b4ce", "comment": "Malware payload (RaccoonStealer)", "value": "b169512d88b8751773282061faddcc91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459378, "uuid": "7f85f3c0-adca-4d96-a51d-379190a082cf", "comment": "Malware payload (RaccoonStealer)", "value": "7a24bd61372a2d42ca880d4c680a9f283e0ae415f2ca5a3f61e8e8db7d9c0f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459378, "uuid": "69349f6b-c591-4573-9274-889babee8d83", "comment": "Malware payload (RaccoonStealer)", "value": "51baa1de9a97b8ad515b541717e538c2b5a3f4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459378, "uuid": "58b0f901-8da5-40b5-8897-0176f411ba34", "comment": "Malware payload (RaccoonStealer)", "value": "168a575eb78c3bf1437d87ebe144758470ff0d56ccc877b99f59e5d87bb8cecd74dbb102e90ecdba5ba9870b2234306f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459378, "uuid": "bf462c5b-ff27-4fe1-8de7-54786eda0a62", "value": "T16534AF1067E0C034F2B712FA497AD3B5A53D7DB1AB3491CB62C11AEA9A346E4EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459378, "uuid": "f1e3a96d-3578-45c5-9f82-ff14ffe4dd46", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459378, "uuid": "0781622f-bb7e-46c0-bf31-0cee97983a9f", "value": "3072:yohYaWcWHem6y/bCDjGixpejzr8pOrZEx2GVxuL80j8payockBNLdJXCWodTOh2T:yorUn6lCzr8krs2GVILt3LDXIu2ZgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459378, "uuid": "067d641f-104b-4ff4-a93a-372154a616b3", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459378, "uuid": "4027c6d8-2cdb-43bb-bafe-170c8b1d8bc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459378, "uuid": "bcae7979-cd59-4774-bbb6-95341ede7169", "value": "b169512d88b8751773282061faddcc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea12db15-25e4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633442565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442565, "uuid": "0a2450ed-a14d-43e7-b3d2-89bdd8eb6586", "comment": "Malware payload (RedLineStealer)", "value": "1fc1c2997c8f55ac10496b88e23f5320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442565, "uuid": "89c26782-d27e-4f35-86fc-5446c14737ae", "comment": "Malware payload (RedLineStealer)", "value": "7a6c03013a2f2ab8b9e8e7e5d226ea89e75da72c1519e78fd28b2253ea755c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442565, "uuid": "38071872-6b59-4e9a-b6ed-f16abef4d288", "comment": "Malware payload (RedLineStealer)", "value": "42c7153680d7402e56fe022d1024aab49a9901a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442565, "uuid": "9c7fb630-5939-4715-8f12-1019718143e9", "comment": "Malware payload (RedLineStealer)", "value": "d63e73b68973bc73ab559549aeee2141a48b8a3724aabc0d81fb14603c163a098a5a10be9f6d33b888602906c0d89955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442565, "uuid": "c20f012f-8d8d-4a06-a28f-c4fc427a405d", "value": "T13794242864BFC05994E3EEA12DDCA8FBD99A55E3640C743301B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442565, "uuid": "6e7e1a6f-55a6-4433-b4ab-94eff1ad91bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442565, "uuid": "949a8b68-24ff-4f81-a5b1-0e7a5b97776a", "value": "12288:jhhl1Eo+iEXvpb1C7drqAd1uUaJvzXGyO2F5V3bS1jsTacr:7lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442565, "uuid": "cba44b71-707d-41e5-88cc-0d96e1945680", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442565, "uuid": "880fb298-9c91-404d-bdf5-c564de5c60c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442565, "uuid": "bc36bd53-870d-4c8d-b196-0ca051665846", "value": "7a6c03013a2f2ab8b9e8e7e5d226ea89e75da72c1519e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d11cdca-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633441120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441120, "uuid": "005039ad-ffec-4e1e-aa10-86b1ef6cc61c", "comment": "Malware payload", "value": "4bc52386de8436c92c9a0583cb6d7da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441120, "uuid": "3d905a27-faca-48c0-9d84-b5a5230193c6", "comment": "Malware payload", "value": "7a6dc9de2a5a7a9e582ab4c712117f6548c08c2cd11552b97b186492580fbb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441120, "uuid": "cd49e292-45c6-44b5-bb1f-cffbe430cf7d", "comment": "Malware payload", "value": "22af1882c29963f697fff9126c3835a9595c4df9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441120, "uuid": "5c29d18a-8c7e-4d49-8a71-fc3007bc3bc9", "comment": "Malware payload", "value": "9cf6c549b06425196cfd69699b5503264e2057cc6e7303c95c66e0ec5337026f200fe892559b6fa21cffba972980b41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441120, "uuid": "d53c0fba-2134-4ca5-8c4d-0f47403d29f9", "value": "T126948D51F28DC1B2E44A187974AC826663B27D28177CABF3A750BF1899F32D47C31936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441120, "uuid": "4fb48409-7379-4758-b8f2-6feb6e062d44", "value": "547cd05356c429dc57b17bf0fd6daf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441120, "uuid": "5c1ec640-85d8-4d77-985b-d3159c83e20d", "value": "3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqot:JjqVG/pJZzfwsGX+LOODVcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441120, "uuid": "5a7a5987-c9cb-49a6-96ce-3cc6e5c066d5", "value": 445686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441120, "uuid": "5309a2c3-802c-4bab-9941-c9d5be20e276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441120, "uuid": "2130e1a0-b0e7-4a8f-87f0-fc62f4091040", "value": "Update-KB2984-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564ebb90-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633441028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441028, "uuid": "1efb57ab-22c0-47e9-a0fd-4530934a362d", "comment": "Malware payload (AgentTesla)", "value": "ada6f784546e767ea1418c8241b60b4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441028, "uuid": "be42a961-64e1-48f8-87ba-ef308de368d1", "comment": "Malware payload (AgentTesla)", "value": "7a761772b7b906213146c778452b08ff4b77f1a594471962eb16f867c7bce88b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441028, "uuid": "fdc4b090-291a-42b5-81b7-e43774a25d4b", "comment": "Malware payload (AgentTesla)", "value": "d10b43534c663e2d309c9de5de1bfc7421c2fad2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441028, "uuid": "cc6d740f-38f9-4532-93c8-53336ed9ddc8", "comment": "Malware payload (AgentTesla)", "value": "49992c6d70d663019165f02d484e4f4b188675d2c9048beee6c5bd5b01eedc565f1a83b054da1cdf44d57856b2e1b5b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441028, "uuid": "990150be-3816-48dc-8428-b02b273f2b3d", "value": "T1A215C5D43386B5CDF577D239F4101CEAF9B8311EE31A8A0260632AD68D6DA42EF2D5D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441028, "uuid": "78d557c2-3ddb-49a5-8200-121c470d9c51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441028, "uuid": "4964824c-3afa-4761-9f6c-8e313dd2c1f1", "value": "12288:HHeSPIif36qdoNd+W046Mnq0UnsO5lJkKzUvoPUu9Yg5EaArYi1pUfMJiWuX0vF6:neSPz5pArYvOiWuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441028, "uuid": "4f31037c-f1c9-431a-af18-46235f1f9b25", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441028, "uuid": "c9b83449-39fb-41e1-ac9d-db0100645ac3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441028, "uuid": "a9877112-3b21-49cc-8960-0db96ff4f0fd", "value": "P.Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fc315f-25ab-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633417920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417920, "uuid": "0eb5060c-d576-4bb8-bff2-a594475b6b38", "comment": "Malware payload (Formbook)", "value": "7e17686d4ba718b453ca93634c1c91ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417920, "uuid": "5c5fe115-8cbd-47ff-9043-0d5c8b47a3a9", "comment": "Malware payload (Formbook)", "value": "7a8cd0fb35936203195d49af3fec0140f45e8b8fb75df0203db6b914d4b8d192", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417920, "uuid": "d91c6016-ad5e-4d77-9c0f-e207cf572f32", "comment": "Malware payload (Formbook)", "value": "a3b28c96da1b78bffdce1c8ead43131f1adb6832", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417920, "uuid": "1cf8e96d-64c3-4340-86c4-e2ba3999e7b8", "comment": "Malware payload (Formbook)", "value": "4b780f0d0ce506c42d0c69e2649cb0cebfaa557313e81a72b96a9b816dd3595eab4b7da8f3fbfb892ae6f277a00d063b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417920, "uuid": "903111b9-9924-4295-9d10-d42208a8a0b4", "value": "T1C1441266F1E0C0BBD19287715A7FA3B9F77ADB1D056DB24B03103E9620851F6CE6A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417920, "uuid": "de7ae145-dcac-4328-9277-8ab9e32540a0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417920, "uuid": "4a9c849d-2229-4cfe-8098-03913f9ea1d0", "value": "6144:F8LxBs+FJekr6Mk5HYZRi4Ax/TH2CUAXH6satHP:/+FJ7Gj5URi4AJWZmatHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417920, "uuid": "c93c1720-d932-43e4-8858-0ee55729e690", "value": 265692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417920, "uuid": "581e0f9e-d536-43bd-8256-ad365f47f59e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417920, "uuid": "7c36780b-0208-47cb-8d00-aaf2125cbcfa", "value": "7e17686d4ba718b453ca93634c1c91ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c980fa9b-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633411586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411586, "uuid": "2713bb62-3c9e-4394-a1ba-c3b43afd89f9", "comment": "Malware payload (RaccoonStealer)", "value": "8961a5db23529a8bfdc665d435327549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411586, "uuid": "0673b467-f7d2-4d97-bc30-4149b7e424f0", "comment": "Malware payload (RaccoonStealer)", "value": "7c21b1b5f71348d4cf42b5ea75b24ea009e86dfae75f8c65d0b62f069863e130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411586, "uuid": "eafae946-9108-4f48-ac38-b8321f1225f5", "comment": "Malware payload (RaccoonStealer)", "value": "93c0e7e3202409653682314086b7e66e609d7c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411586, "uuid": "370218c8-ebc4-4877-9af4-27adb1c02bfb", "comment": "Malware payload (RaccoonStealer)", "value": "9ea43fdbd9652af857e09e5a8ff4cc828783d68c2297fb11504cbb16b145fdbce2315680df6fae71f0c953c2f8cc123d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411586, "uuid": "753ca949-1905-4112-b293-649625628fbb", "value": "T17BC4F10932A2DFF6D27441F1AB2AC7F0092DBD584D2AB34B37A4771E3F3D291AA11215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411586, "uuid": "d1874c3a-ea55-4e52-8f14-3cd8074b37ff", "value": "0c041fb9d9286e241f4f51f0ab8f3f03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411586, "uuid": "3cffdd9d-70c7-41f9-8f2d-d9c05057dfdf", "value": "12288:MiTwBBkVMAjqWc7c+AK8naJQ5OdnH4jaL6nxzxd6L:LaK9jTc7JAKEt5OdHNmdL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411586, "uuid": "35bacc6a-1691-4c70-9095-e588c121b359", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411586, "uuid": "b9f0e0e4-08f2-47cf-9865-bf9017166157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411586, "uuid": "becb53c8-b57f-40c4-b633-7eabff75c253", "value": "93c0e7e3202409653682314086b7e66e609d7c97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30cec99-25ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633418850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418850, "uuid": "2326bf14-e848-4adc-bc09-daacb91d1898", "comment": "Malware payload (Formbook)", "value": "f858612dba7ed5eabd87e508083c34f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418850, "uuid": "cd325735-4d29-4054-9197-90fa909eb236", "comment": "Malware payload (Formbook)", "value": "7c7e7d1ad3f8afd0ffcba163bac7c1df9ceb8202a96a61b30b697569e00051b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418850, "uuid": "d6333ddc-00be-4c0d-91fb-ea0a72071476", "comment": "Malware payload (Formbook)", "value": "0870abd54c8372c738f29c4092fe8123b45a305e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418850, "uuid": "93e17ef9-ac50-4a0a-a82a-38ab1face9be", "comment": "Malware payload (Formbook)", "value": "8c70aa267f161c7f542c603fad925c64ab115410bc804ca9f9a8f4438248bb5f27554a51d4a96d0933a167a6ffef51d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418850, "uuid": "19a0edd2-fa47-4d0a-8f66-9962b0dc9dd5", "value": "T145441217A2C05477C2E65AB14C71D3BEA7B7D00054438A47CB842E3BABB41DA5B5F3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418850, "uuid": "2c0b4a81-d3be-4f05-a070-2aaee3379d2d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418850, "uuid": "3a7b47f7-6964-4cea-b673-37e1e54df182", "value": "6144:F8LxBsho/iuY/Zu9hK+b1A/ccNktx+d0UWyj5J70REgmD:/ho6uY/clb1QcMxX4eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418850, "uuid": "d980c34d-84cc-4270-99b2-4e6d09b8e1c0", "value": 262217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418850, "uuid": "225d6ce3-bc7a-4b0d-9127-cd1f93cd2848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418850, "uuid": "ac766df1-717f-4e18-99ff-e650860c9d25", "value": "f858612dba7ed5eabd87e508083c34f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db46b89-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633417069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417069, "uuid": "cd12f630-0805-470a-a96d-9112d8a50cff", "comment": "Malware payload (NanoCore)", "value": "1abe6ef320dc62c68bd87a81b6061275", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417069, "uuid": "c9a5b16c-f072-4690-bbfa-ec35d12f7133", "comment": "Malware payload (NanoCore)", "value": "7cd5e61342f0cfa2fe97d0db905e8c012a2d6d32e410df84e865f8460d2c4b00", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417069, "uuid": "b41adb55-102f-4457-80f4-4c8827477483", "comment": "Malware payload (NanoCore)", "value": "abb0a5a1cfc21468c31907b9bac11e2e10957950", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417069, "uuid": "4b0c2e2b-4b35-4eba-870b-2b2ede04bd33", "comment": "Malware payload (NanoCore)", "value": "55e230cb9a95be431db8627453b4e871ccb53263ee67a3d231a7595541c76aaa01bc55212a11f6528b75010cea4d9b90", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417069, "uuid": "f8f8dd4a-6136-4a10-ac7f-652dd66af29a", "value": "T16F35AD39B3CA7E95D81C1F7EC813014483E5CC671737F6AB68D12ADA0D19A9B9B2F211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417069, "uuid": "e8460037-f679-49ae-b4d1-99c360fd0812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417069, "uuid": "53da2965-968b-4fe0-882b-f5a140d02db5", "value": "12288:o1ppLFIW3PwqiN2iNHc1MwJ7D7OYyZUVwaCJe0Igt7oa3KsLSEtPh+:o1PLSW01Vcn5OY7sJXIg5SEtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417069, "uuid": "a96ac90f-9fbc-4fe1-a160-42642dc8a671", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417069, "uuid": "029b1a90-a046-419e-8827-86363bbac41c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417069, "uuid": "e0f5f628-a4bf-47ba-af62-4e509468cb18", "value": "DHL_Ship_form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcc3f02-25fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633452768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452768, "uuid": "adc7d788-56b4-4a9e-bf47-4d03f62890b7", "comment": "Malware payload (Metamorfo)", "value": "518c1c2da6fdfe8d2c647626612f80d5", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452768, "uuid": "5e7ba751-cf8d-4f79-81ad-73377fccf367", "comment": "Malware payload (Metamorfo)", "value": "7d5b8638766d477192401b0ca88e23f43792b4602437e0461b06b87acf8a4e81", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452768, "uuid": "e037c66a-e1ef-4049-947d-6c1a22d8dae0", "comment": "Malware payload (Metamorfo)", "value": "7369c73b2d2d33580259820f39e3bdb1c1fbda98", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452768, "uuid": "02b31bc4-464e-4255-a87a-3fe6f8a732b0", "comment": "Malware payload (Metamorfo)", "value": "afd86c7a9c3daa35f8a19ad8da5ba782296c2c0c5ce778acfac0faaedd26325162d6fb7c4d63baa37f3f9debb0a9c3f4", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452768, "uuid": "424d4989-5f7e-412d-b577-6783a7dc1e38", "value": "T11C31DD051EEA1329C3B3CF7A507BA2074A76FC51AE934F9D808497DE28A1055EC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452768, "uuid": "eb151a21-f1fc-46a0-933d-4743ceea8ad9", "value": "24:8+JUHRlVo5kcbA+Py+/P+P+taMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+FTd1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452768, "uuid": "5d8676eb-8f46-43ff-8433-df78676c465e", "value": 1544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452768, "uuid": "16a4b75f-1db0-4b46-8c4e-71029e5cfd17", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452768, "uuid": "0b144742-f994-446f-9501-3632311dc4f9", "value": "BoIeto 05116510.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9eb363-2599-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633410248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410248, "uuid": "3f1b9d76-db68-4321-9c87-219e8315b402", "comment": "Malware payload (Loki)", "value": "74cb90e5f69bc9fd64beebfce2af08ed", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410248, "uuid": "5fd7034d-2e24-4458-8331-0be84485873c", "comment": "Malware payload (Loki)", "value": "7ded94da0f651747fe6e5a5d31a907fc85d3f22f818cfc66eaa5fbfe0886759f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410248, "uuid": "6c29c724-6983-4228-b913-9e002c9ad760", "comment": "Malware payload (Loki)", "value": "17f49d026d3a93c89ad222f7f45d72c07e915d39", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410248, "uuid": "259ddfdf-4380-40d2-9afc-f4f660a789e7", "comment": "Malware payload (Loki)", "value": "ff671757f6c94645199c1de837344aa1e17ef351e90a8959397969efe8bb3a2e746a6d9faeb9f8c49f24e5ca929a8cd9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410248, "uuid": "805dfc24-f897-4e69-9137-9a2d075fef7b", "value": "T1A8642369E90E78E4C99BA8FCCA0045F1720C36445F94E25F69F1B0A21FCA5A707DF28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410248, "uuid": "a75047d4-56c9-4be1-86cd-5ae270ed7bb6", "value": "6144:nUv0zJvljC3bRcTY3uHUqla+0NDYyhsPEtqDienxahL8J7fzhYBe+RcRrRgF:nUv0VpqbRsHUya+0N8yCPEcOenxDzh/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410248, "uuid": "e0f8f44c-a903-4bef-bbd2-2818132c5cca", "value": 328751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410248, "uuid": "981f138f-56ef-477f-b9ef-2b4eafc807aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410248, "uuid": "49b2481d-6640-4a48-aa21-58582c21ad34", "value": "12005 RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa01e17-25ea-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633445124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445124, "uuid": "c9692ed6-9541-4e71-b397-58af4ddc7306", "comment": "Malware payload (Quakbot)", "value": "0fa6d29d1bdcf702fad11358b3dff5e9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445124, "uuid": "85ec9ff5-488e-4693-817b-6273d89e0b23", "comment": "Malware payload (Quakbot)", "value": "7f67497803a8766fd44e2ed7607b2fcc58b9452d6bfb27059896bc918ee21404", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445124, "uuid": "8ab8d323-7ff3-450f-b113-bda290056596", "comment": "Malware payload (Quakbot)", "value": "e0163cea235943ea264ca87ce3865fe76348a0b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445124, "uuid": "db45760f-3bc0-4b2f-bf7f-f5364f602ad8", "comment": "Malware payload (Quakbot)", "value": "e39e840035cc65664779b8bf94e09bb4aa715f1b1bd2a2fd60ff62e7d3059ac72de9587f82dc52a9f3a8d3410b04b264", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445124, "uuid": "c87eccee-27b8-4f0a-ba43-35708c15cb8d", "value": "T177D3AD563797CA4BE54913398EE3879B3B72FC21DE72470332453B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445124, "uuid": "4faf470d-b7e9-4bc7-a745-95987e729c03", "value": "3072:3k3hOdsylKlgxopeiBNhZFGzE+cL2kdAGc6YehWfGutUHKGDbpmsii8u6ItC06vS:3k3hOdsylKlgxopeiBNhZF+E+W2kdAGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633445124, "uuid": "7c449a14-5dd8-462f-b0a6-3e8f628cdd29", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633445124, "uuid": "10f7e85c-d7f4-4d7b-9908-a330a6244e6e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445124, "uuid": "fff6f90f-d248-4e03-a582-cb84de4699fd", "value": "Rebate-1641662326-10052021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f807a5-259c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633411255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411255, "uuid": "3b099387-2646-4bc7-af96-cd936a7c7cd5", "comment": "Malware payload", "value": "78ff7410d48587c0228f648c31deb8aa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411255, "uuid": "3df25fff-2aae-4d3e-857c-dfcf62749828", "comment": "Malware payload", "value": "806c839bd030a065c701999f2b1d43c20d53bf0f92fc699d46eee920a853c883", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411255, "uuid": "7321deb5-8ef8-4cf4-8dee-ea4907e9d944", "comment": "Malware payload", "value": "f508f8c9ff17e4d61f472a830260d6de9d2f1360", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411255, "uuid": "2b187bf0-2c78-4895-92f4-1dd0ef47cc75", "comment": "Malware payload", "value": "708de19b136ea0c28dd03786cd0fd6825497d0f9ae5c542e3aef7ce47ec4fbeadd0bb4d34727a660b6758a301c0fd99a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411255, "uuid": "a4b8ba2c-2deb-48e0-8210-b266ecadc29e", "value": "T1FDD52307B2D58BB2E56A0270978BD3265275FC308522851763D96A1E7DFB2A0B3F37C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411255, "uuid": "2551165d-e97b-46a2-8865-5f4a6f255c1c", "value": "49152:fMkuY5ASbLFtk1F2dTQo8YJB2O3BGaFXcn2vFBRsd/CLGEAtHKCLbHJXon+s9B:sY5ASbptW8dso8MBJxG6E8Fi/aGE9m7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411255, "uuid": "a20c9e76-d9ac-45fe-8323-f47eb919e585", "value": 2821632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411255, "uuid": "ace74643-a2e5-42fd-b24f-fe754c180682", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411255, "uuid": "3532f59c-5692-44fd-99c1-b9eaab816b63", "value": "Conta_Claro_Out_21_09.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f49cb1-25c8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633430431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430431, "uuid": "b5a6bd7b-84b7-4b5a-8288-f711c428842d", "comment": "Malware payload (AgentTesla)", "value": "327de69d221e19176952290fca463884", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430431, "uuid": "a567b216-09f4-4a11-ac3e-b2a19f06259c", "comment": "Malware payload (AgentTesla)", "value": "818028eb2d8a37584b1801c241ca0648cb6e2d4f63bb8246311fce35d2db39e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430431, "uuid": "549b3ec3-badb-46c4-b701-b5e02143554d", "comment": "Malware payload (AgentTesla)", "value": "6028407f7380eef559dbb3e3efdf39d9a831066c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430431, "uuid": "04221ee7-49ee-46cc-9365-d6813997e388", "comment": "Malware payload (AgentTesla)", "value": "eb164d24a0197e1b87ee80cdc4ccfada0dcae82f1ef368bea8a1b5d52b1d36d03ea8d10ea3cdfdbb66f56c6095d7c707", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430431, "uuid": "78bcdb82-6ccb-46bf-b10c-4cc1e62aea4d", "value": "T1F5B4DFA5236F6B45ED348FF9181CA49153F67C3B2179D3690ED1B0EE2E22BB00A50B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430431, "uuid": "02e29c10-62bb-4187-bdf3-e7b4db4b0361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430431, "uuid": "3ac21ded-bb34-4dd1-b8d8-cd358da6f403", "value": "12288:xt0occ0WZuH6VyRZfO1rr/ttiZ/1DrYK/xX3v:xt0rc0WYHNZfO1rfiZtrDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633430431, "uuid": "505b93cf-6357-41f6-a053-4086db6da38a", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633430431, "uuid": "0ad98382-e9ae-4f0b-9a92-69913baac4f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430431, "uuid": "5bdc539b-4d97-487b-9459-aff12df860ca", "value": "SWIFT MT760_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ee70b9-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633413137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413137, "uuid": "9a36b5e8-17ec-4130-9216-678c77f23205", "comment": "Malware payload", "value": "dc92a9e38f2d53c87c4cb49696876887", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413137, "uuid": "af3b249d-708d-43ea-99e2-2120321c9e3a", "comment": "Malware payload", "value": "822b550d4a5a64cbe34058a8af2b249fc134f437fd09f86435d3324fa813571f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413137, "uuid": "eb80d0f7-b08f-4eb4-a0d8-b11055694b86", "comment": "Malware payload", "value": "0463da8686d7d855aef029ce8eea8a2177fdf088", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413137, "uuid": "42bb5187-d012-425e-88b8-3a5c9be236d5", "comment": "Malware payload", "value": "dbbeb9e592556e16cf61b122c35f683eaa248140c8f42b9bf1825a2f7aee5af2005a139d8268e3ccd344d4998d9b8c0a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413137, "uuid": "205c7f77-bd5f-4b97-a4da-04a20619c0a7", "value": "T120B50E06B52676D3D32B14F0026B7A0E811C798691CD0D8A485BCBDE6CE5CF9E34AE5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413137, "uuid": "68e269ab-b17b-43c5-86f8-9255ace35199", "value": "1536:6i/ZfvkkjHUoUMUDUrUNUGUMUHUBUTUnU3UNUjU3UkUOURUUUHUBUTUnU3UNUjUo:ER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413137, "uuid": "b5e0cb87-381f-440b-92f2-f8d6a1c17ed9", "value": 2273708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413137, "uuid": "60cdf873-3077-471f-baa6-429b33127196", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413137, "uuid": "fb00b44f-ddc0-48e9-8676-6891058275a1", "value": "PO_1048575.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db2d948-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633411405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411405, "uuid": "85caca5c-8c6c-4dd3-9021-28e4f309d8cb", "comment": "Malware payload (Loki)", "value": "9aa424311767b1d0d14dca08f92aa051", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411405, "uuid": "f6daf70b-0143-44b2-b545-b25813a62fbd", "comment": "Malware payload (Loki)", "value": "82983f89d74528d38942945e80dcca26470ce743aa86a63cd8f4dfc0017e770c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411405, "uuid": "c4957368-690c-492a-b4bd-d2a4830390a5", "comment": "Malware payload (Loki)", "value": "423429da1ddc03ac34a31bd8008e78f73b2750de", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411405, "uuid": "1b452ffb-923f-4698-9252-ccb1c1e3a16d", "comment": "Malware payload (Loki)", "value": "3da8f7c68b58558de20f9f4c4214c0463489c6723402ea06a8584712bf2269c085153f0663fb25a76660854e3495672e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411405, "uuid": "490e19c9-367e-46dd-8d4a-81e80c11a824", "value": "T1E16412BD7AE57A17FE83767BE89CD9082432DC678BABD0A21134F28862B434141D5F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411405, "uuid": "ec87b953-6bf9-4864-a777-39c13da46663", "value": "6144:zNlG5HqX9MPO6Uu1GDZAkJehwB02GSJ3t8yqO7xzWxcRT9Z2cC66YENgVg2oZl:gK2OBuPKP60dPN7FqyT9Z2cUYEaZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411405, "uuid": "08d4a37c-a9d1-4076-8d81-a59c5743df02", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411405, "uuid": "0de23a9c-eea5-4a49-96b5-adecc137a2ba", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411405, "uuid": "db48edf4-3467-48d9-bac4-b8bcd7b10513", "value": "11882.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4e614e-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633416639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416639, "uuid": "614af504-7b94-45b2-8ba4-b0654cbfd73c", "comment": "Malware payload (SnakeKeylogger)", "value": "a3c10a1268291d625d268bb7c28de7f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416639, "uuid": "cae554d5-1722-4aed-89da-c070be366c14", "comment": "Malware payload (SnakeKeylogger)", "value": "8354233118186bbd3cb2c83862d11174e89e795b5e041837461e908a7dccc5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416639, "uuid": "38e5d18e-dae9-4882-84c9-181d19c4a663", "comment": "Malware payload (SnakeKeylogger)", "value": "b26b821ced0f5822fd51ecfdcd964a57b7d3ce51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416639, "uuid": "eff2cc3b-6425-4a13-b300-8c0eac291c0d", "comment": "Malware payload (SnakeKeylogger)", "value": "0a5d80b248f16ee57c22ef83d167eeaa2ea3b2e21fc23e7bd91d38aa6b7838517de9f19b6f77a92ee0c0c145e9d3a585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416639, "uuid": "0e3bdf83-ee67-44ee-97d2-385e6e94eb78", "value": "T190D42352081065F3D8D364302EEB39B6F27EB1256213898393E55B1775A12DF6E8F0AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416639, "uuid": "9828fbf8-affc-4ebb-a82c-3a1294d8a4a9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416639, "uuid": "7bde7a21-a18a-4231-996e-06af98a7b471", "value": "12288:ys+k8A1zSTlyYvmBDOW7dfxaaqHJD3GrzWQRwEbhEQPOwYot8DPlAB:P+kdzSTtvmBDOW9xaaY3GrzV12twYo6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416639, "uuid": "b3c3b791-d8ef-491b-9b83-9b1e23efbe4a", "value": 634243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416639, "uuid": "969fa8af-c65c-4c5b-9a43-7ea20ba62e3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416639, "uuid": "6aa8941d-bcd4-4654-b238-a6ded1f2272b", "value": "20804567890987654309098-8765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469d1bef-25bc-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633425111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425111, "uuid": "cb016283-f2d2-4fbe-9cce-e84d689ad88b", "comment": "Malware payload (RedLineStealer)", "value": "35975cf735ef37cb9dbbcedb0881c837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425111, "uuid": "e2eab74d-1274-49b6-8586-f4ec66025380", "comment": "Malware payload (RedLineStealer)", "value": "8357cb9c448c7a284462d7d8173f68ac4c2383363a325112908e18b44f5a9ae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425111, "uuid": "16b5816b-1153-4dc2-8d0a-84009aec8778", "comment": "Malware payload (RedLineStealer)", "value": "1f1e1b6d9435d9c7952913ae97f9402fb8f545c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425111, "uuid": "ea921556-3322-4e31-b0ed-6286f4df0f98", "comment": "Malware payload (RedLineStealer)", "value": "08a582c2590e3a710b51d42f153db81e68df35bc5b059e27bca816726804d01c545e9a431626df77fcc5e91f4cc57114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425111, "uuid": "6a97b867-ec78-41f8-8b19-14ec1b093662", "value": "T16D348D1067A0C034F1B712F949B6D3B8A92EBEB1AB3491CB66D51AEA56787D0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425111, "uuid": "5a22e377-4353-40a5-adbf-5dc0f95c53e7", "value": "bec5279be0cb3c653f5b0b143b00a99c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425111, "uuid": "bdfcc1bc-78f2-412e-95e8-39a0d1e68ca0", "value": "6144:A4N6qW6n0Md1r7Ovt3tKiozIM2p6LGDUz/eaIV:AkWY0Md1Et3oiOIDXVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425111, "uuid": "fcd4c5ad-31d3-45c0-bf90-ebef6c18ff23", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425111, "uuid": "441fa66c-face-4967-be47-173ccd9115b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425111, "uuid": "16f7f25b-9f67-414c-a295-b9fa1d56a64c", "value": "35975cf735ef37cb9dbbcedb0881c837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728e5365-2620-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633468134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468134, "uuid": "9e81213c-e695-43c0-a230-001e866519a4", "comment": "Malware payload", "value": "4e224c189b50b39268c38c04ca5e48f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468134, "uuid": "b6de5012-b8f0-4b63-a74a-c0f01cbad70a", "comment": "Malware payload", "value": "836a211bf7485ac9187eb1da2f8658070ccd27533c83c60976eac54d952bfc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468134, "uuid": "f89459ae-a676-4b2f-b410-6105441f709b", "comment": "Malware payload", "value": "a81bf7bccf3b35ac89b979e3ac2e756ce22722f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633468134, "uuid": "58878626-6d0d-474e-9ef9-7543fbea98af", "comment": "Malware payload", "value": "c5a3cc5fb7ce810bbec7b88cf3a8e085b1b009288610a45ae5a89f964bcb37f8bc695a45e65ec2ff62a22eb3cc52f5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468134, "uuid": "aa5855bd-480c-437b-a858-01c4a8795b0b", "value": "T127055B74B6E45E77E1C22AFABC0E67D695257C213804D6C626DC6ECC7A713E1272208F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468134, "uuid": "6ad12957-1cc7-4887-a03a-090c1c6b0bab", "value": "961dc513b005c9fa212a47cb8687ac19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468134, "uuid": "90bb5361-bbe1-4f81-b1c9-b82bf22b2b50", "value": "12288:zRYwRSGgqDb08Akp0RdhEKmb4Brin4uq89:lTXgqDb08Akyyzbcin4t89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633468134, "uuid": "bd0118d7-05a0-4244-8c31-4a42524ec746", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633468134, "uuid": "59ddb29c-7aad-437b-a473-e79009b9878e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633468134, "uuid": "4e8ab00e-9c0a-4338-8501-485eb9c08d2a", "value": "SALARYDOC,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5fce8a-25d2-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633434732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434732, "uuid": "0160e03f-2915-415d-bfa9-185391012bf9", "comment": "Malware payload (CobaltStrike)", "value": "63a7a72bde0af31057672d7534b7e245", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434732, "uuid": "6438e832-b2ff-464b-aa10-55a0dee536b1", "comment": "Malware payload (CobaltStrike)", "value": "8384650d6af180f802ca6ee4db2e8fff584b7155f2f58b95fed357445fff9d4c", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434732, "uuid": "e29847b6-7ebe-4941-ab20-d324a84ffb4a", "comment": "Malware payload (CobaltStrike)", "value": "4caff022234b093867d77b6377dd0d423468a503", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434732, "uuid": "f787ad31-b6a1-4eab-a7a1-93b2a95d609a", "comment": "Malware payload (CobaltStrike)", "value": "53b998dd3fad5dbfc2279953768597076daa80f21bc0c213e7a3010f000f1b64b528423f8fd66841d162f127c4d73f1a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434732, "uuid": "19cb633a-6b19-45f7-9352-8702d82bbd1d", "value": "T1E924CE31360F3DBFF82548FC68D1103ADF65AEABDA9CCD4EDA9CA14046C994B0F12426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434732, "uuid": "7205cef0-da2f-471c-9ade-2b754d77e7c3", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434732, "uuid": "612eaea2-20f4-472e-a6cb-929dc655c8f5", "value": "6144:RdbIm87Xx9Ux+iQoLPbQQ/30p2MpVxNk9a2wCgNK4:Rlr87h9QQoHXc1S56j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633434732, "uuid": "fd78e482-d092-4ba6-a4c1-879682e4e71b", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633434732, "uuid": "b1cd6ab7-9c8c-4dce-b429-5d85754c75a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434732, "uuid": "8a650da0-234a-4e62-917b-f7d8dd021c25", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73d4fd8-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633413274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413274, "uuid": "f3016434-df85-4efb-b66e-f873bebfb11c", "comment": "Malware payload (SnakeKeylogger)", "value": "fba23cb6fdedf626e34d6065c1b9740d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413274, "uuid": "286db131-ee9b-4db5-b317-c166257e468a", "comment": "Malware payload (SnakeKeylogger)", "value": "83c91770a4805a1a5e9311cc586cee239b55168a6c145e970818ad147a2ad464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413274, "uuid": "ff9f688c-f0c6-4cd1-bee9-142351522dbf", "comment": "Malware payload (SnakeKeylogger)", "value": "cc893c11762a50ca3ddf69b72e3439661da05359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413274, "uuid": "1f104598-201e-4fb6-9313-d438b2a97876", "comment": "Malware payload (SnakeKeylogger)", "value": "ea296bcb01032d7903734258f3df4a35a3f181b13641f184fd35091b648755823492f09c6f388f3b18344eaa45414b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413274, "uuid": "06498cef-d14d-4f32-87cc-2b9a3b523381", "value": "T1A2D458253E1286B6C87C1ABED63843C0A23D7C136F70E2BD6FB4369916F728C494D596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413274, "uuid": "c8c7dad2-35d7-482c-b654-df3e97231950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413274, "uuid": "843a3a89-871a-4f97-ab73-8737c7696ea4", "value": "12288:ObTJv/dUvdZroyTYiZtT/BE0D/9qobOc8w/wc9NMZmKWQG8E:WOd+yTdtLOAqoyw/PU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413274, "uuid": "e22cfea0-06b0-4fc6-86c4-5ae382163f84", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413274, "uuid": "6631f1e0-5927-417f-b679-7321f485b3cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413274, "uuid": "f3f1096c-516e-4b11-b781-ff5d766a8400", "value": "RFQ-847393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6ca21b-25b4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633421770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421770, "uuid": "a7b6fbaa-a185-4e01-877c-58e35da6cc3c", "comment": "Malware payload (RaccoonStealer)", "value": "3fd90b67adbaaebf3037f75cf4eb42e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421770, "uuid": "48b817eb-221f-4dba-8ba7-46c2679db9cc", "comment": "Malware payload (RaccoonStealer)", "value": "83f98530ac0d0e3be6e4f0e363bef49a3da660440744615a22d96adc852310f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421770, "uuid": "0c9b2136-549e-46c4-91b2-0f02d6b7bb9d", "comment": "Malware payload (RaccoonStealer)", "value": "339729f3e6ac254eed1c8e11e58a904a130b0ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421770, "uuid": "4deb607f-5647-4987-8c8b-00d4c745864e", "comment": "Malware payload (RaccoonStealer)", "value": "15ba6f47a308bba364c91a493d3d01370d61fdc8254beacd0cc45c0a3d10af471f0e234ba9c4a24383038a3ba415f8cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421770, "uuid": "41d863f5-9dca-4098-8319-e4bb54c4ea76", "value": "T12DB4E110A3E0C034F1BB12FA05F983B9E52DBEB0672495CF56E52AED56B85E09D30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421770, "uuid": "bf77d8dd-354f-472b-bf3a-ae6ab1c6f9a8", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421770, "uuid": "39604e4a-ece9-4158-aeec-80d6a51b1fb5", "value": "12288:JdP+0B37jAeZJEvtbLFnqTWxvocsZBRc+4S96rDFJ:/DN7jh+FbLQTtcO0+DYJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633421770, "uuid": "10d0321c-0718-4a25-a27b-55ede3df7f97", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633421770, "uuid": "a883343d-e05b-4a83-891d-bed93f3b6990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421770, "uuid": "02949d58-b489-45e1-b23c-def0deb565a7", "value": "3fd90b67adbaaebf3037f75cf4eb42e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73359ff4-25d6-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1633436352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436352, "uuid": "a810da93-dd21-46af-adfc-c3adae7d8e0a", "comment": "Malware payload (DarkComet)", "value": "a4522cc6766a5e41863d96f83a4bf210", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436352, "uuid": "8689bd6b-fcad-4811-8d2c-f41cef712c2e", "comment": "Malware payload (DarkComet)", "value": "843495a7b1864d2053d8d5079f0323e2af684559f73bea1c09d0a44f63d880c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436352, "uuid": "a8f6832f-3bc0-4734-8df7-b0a59aa6d09b", "comment": "Malware payload (DarkComet)", "value": "978afb58c4101e0463dfa0a1d80d86c972f544c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436352, "uuid": "74f3ebf7-4a34-4fc4-a462-42b69d0c5b71", "comment": "Malware payload (DarkComet)", "value": "4ed1f687c97d2f89f276e2b316dd911a2b003c3395771f979a10e5ce1a8a28b880ced96e2118b34c55d0a552d3afd823", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436352, "uuid": "4957028c-1fa1-4f47-b403-87833de4f6cd", "value": "T1B2C423A09BD54B12EB95583E049525DB02E8EAAFE7335E56040F7378BE1B6C00973FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436352, "uuid": "8b192fb4-de59-49a9-996c-edc7abc2063b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436352, "uuid": "ad28984a-9083-466e-9d3a-d558aee3fd26", "value": "12288:HBjDbgTLHiQKV1EWzlH5I9GySnouCuNI9OeM1Qw:hjBQKPEWzjon9OeM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436352, "uuid": "3590e1f4-6334-45bb-bc5a-2c87ca962495", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436352, "uuid": "10803b65-b9ec-4e05-b617-090ab0c8dc2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436352, "uuid": "38e0b35d-a7ee-485e-9ba1-f83aad86b211", "value": "a4522cc6766a5e41863d96f83a4bf210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989f8cfc-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633441999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441999, "uuid": "6a1effac-bf34-4dae-870f-83881726380f", "comment": "Malware payload (Formbook)", "value": "83a32d0d136cadf943aa605a7b1e3dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441999, "uuid": "7eb97261-5721-4f06-8c01-98d1b2c072bb", "comment": "Malware payload (Formbook)", "value": "85eb901d5863c16a7526addfb18464967c45348aec3e1d1bf6014958fa4aff8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441999, "uuid": "ad48a207-34bc-45d8-bf0f-2de694558525", "comment": "Malware payload (Formbook)", "value": "c83cb3c6499bec6dcdf600d4d7e82638fa9a6cf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441999, "uuid": "d4791c20-a580-469d-9c9c-d8c7e117805b", "comment": "Malware payload (Formbook)", "value": "28b68082266e5c7e206eaf3999a600b15ed317dd7a4abd9a1d527514a1f0e2e4408ae0a45b4a7e69a10117a974decb14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441999, "uuid": "48c005db-c866-470d-8eb2-13cea35cb03b", "value": "T1A335AE25B3CE6B92D82E0E3AD923014583F089171732F76B6AD13AE60D25FD79B1F191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441999, "uuid": "dbbf9dec-295e-454c-af31-53a263e9557b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441999, "uuid": "f3744742-01df-4286-9a18-7e38d1c0acd2", "value": "12288:6KFJzCCj6OrFr86CDMhz2iNHc1MwJ7D7OYyZUVwaCSxSv7GlaSVX9hF2sweKHHA:Vv16o986CDMhz1Vcn5OY7s+2GlaSiyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441999, "uuid": "b68e301a-d237-465a-abb0-ccc7e58e571a", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441999, "uuid": "ed1aeb6c-f1a8-4055-abbb-2b3278533694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441999, "uuid": "9088d4a2-da26-407a-a2d5-96081c1d7526", "value": "DOC20211005-0918629831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06004533-25eb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633445188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445188, "uuid": "309fa124-f2d9-486c-9cc5-976ccaacd710", "comment": "Malware payload (RaccoonStealer)", "value": "2d59ec6d1d1541388eaa66015b3a5922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445188, "uuid": "c933b762-7276-4d8f-ad42-80b67f5ca2bc", "comment": "Malware payload (RaccoonStealer)", "value": "860a9128eef86371ad40df534c7153e7756ef99c32792553bc25354201ae16e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445188, "uuid": "0f1053e7-3736-4b07-91bd-d397833d4111", "comment": "Malware payload (RaccoonStealer)", "value": "5651b2778a918477ec9bfb8efc49399979d19ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445188, "uuid": "6c0f9847-5ff0-496f-bc86-cc570bb63c01", "comment": "Malware payload (RaccoonStealer)", "value": "9ae52f27f208a126efafec6c14417a4aa9999f478cb432e3f4b71fb5bba46425c22cb2b6727e6b13d17c6e4d534a61db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445188, "uuid": "75ab3a97-5392-47c0-8cc3-fd170fe91cea", "value": "T17EB4F111B7E0C031F2BB12F94AB983B9A52D7DB16B3885CB96C616FA42346D0DD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445188, "uuid": "4596785e-2449-48d4-ad7e-f8bf153694d0", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445188, "uuid": "2d49fbbb-76db-4ba0-8a76-ae645a041be0", "value": "12288:+7WAeavqOrUtgRIoHzXgmWCW+n4SVvBWBYj1:tWTUopHr++n4S3WBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633445188, "uuid": "8a9b82cd-8ded-4037-ae4c-c0bfcdb37bd3", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633445188, "uuid": "441b549f-d5ff-4712-8fd3-4063e4d7cb5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445188, "uuid": "28946af3-aef0-4e01-9ffa-967993c2d173", "value": "2d59ec6d1d1541388eaa66015b3a5922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9972ed-258c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633404719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633404719, "uuid": "910303d1-6646-44b5-8d2f-0d0d63566936", "comment": "Malware payload", "value": "ac5be9acf1fe217e9bbe11c4a8445583", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633404719, "uuid": "5f5e2ea2-ff20-445b-91ad-e1a20a5df7a2", "comment": "Malware payload", "value": "865689bc231393a837582776aa5e27f5fbfe1c08f31f59645dd72e39a94d59af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633404719, "uuid": "b4fa1fc5-7b0e-4ab2-8873-88d1e6ee8a99", "comment": "Malware payload", "value": "dad01ba482bc1386a6d043f13665f0b9a8b31892", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633404719, "uuid": "e1be6715-d92c-47a7-aa10-9ec11918612d", "comment": "Malware payload", "value": "90e0307a1cfea7994688ef9cb1cd8619f06a64b5d01c0073f80c68c8985332453439076701eed206764b81209107620f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633404719, "uuid": "94248275-569c-4d13-9295-c559c2bf765b", "value": "T19314D048E547C8ADDBAF52FE7DD98AFD83547B050889153C6A3A981C332E5B30C9F825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633404719, "uuid": "2e19b37b-e635-4c67-9547-953e79997edb", "value": "3072:wbjCOmwMJp+qmFxn5eKyVomZJhRQjx2l68Ps2TpGUv+6aW0ru4+sGhS:4jCOD6p+zFl5bmHZPRWwf910xmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633404719, "uuid": "01c47b7e-902e-4d66-9ef4-2a29b775d196", "value": 196685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633404719, "uuid": "792ea6b2-7d9f-48e3-815b-3a5eda5bf55b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633404719, "uuid": "278e636c-6f7f-4d24-ac32-2c28b6ac4560", "value": "termination.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee8a6a7-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633424534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424534, "uuid": "6c531a60-8fb6-4928-bcaf-5a11d28fbd68", "comment": "Malware payload (AgentTesla)", "value": "24c03eb05429ceb15107042b57b23c1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424534, "uuid": "d6703a0f-d336-4b56-9b3a-8cdf2441d7c1", "comment": "Malware payload (AgentTesla)", "value": "8664bd0c09f992c53b0db3db2b6d5b5a14802fc7dd98d2e820d2df78fd26764e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424534, "uuid": "511f6bb2-4585-400a-b14e-78a8a50eaa34", "comment": "Malware payload (AgentTesla)", "value": "3d8c35372e582a8741bbe3fb28598372d56cf7d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424534, "uuid": "577b949a-1f2d-4fac-9e8f-d70b66765a1c", "comment": "Malware payload (AgentTesla)", "value": "388023cb7e42fecacce625cdc82b15ae0829e3ffa1a7634e62d18bc3700d23c91d382d644fbffb96cb58973f48142385", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424534, "uuid": "52fbb815-21f7-4d6a-be32-354e18332d72", "value": "T141B4D0A833AFAF45ED398FF4146C909153B66C371079D7690ED5B0EE6922BB00A90F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424534, "uuid": "f1780ce8-16a4-4975-85c6-43da2fc9fcf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424534, "uuid": "d39342e2-84d3-4fb6-b53e-98c5d5aee77d", "value": "12288:9g9occ0W2NLKHpUXxTNMNgIT5BbN1xcPUW8G:i9rc0W8LKHpoxNMNhVN1UGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424534, "uuid": "694fc023-6ef9-4dab-8a31-f9d76aae8512", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424534, "uuid": "dd9bf163-9133-4720-bcc5-7b65bfe4341a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424534, "uuid": "d6e15aa7-1d95-4faa-b5f6-cc0d6de7c62a", "value": "New Inquiry PR #270473. 05.10.2021.xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb799ae-25a3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633414575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414575, "uuid": "e0a64f57-5858-4b5a-a87d-e3b9c91b9203", "comment": "Malware payload (RedLineStealer)", "value": "7fa4c9662047092a7709c3537ae7ac30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414575, "uuid": "93c76e04-3f8e-46f6-9316-0df6240c6534", "comment": "Malware payload (RedLineStealer)", "value": "8688ac41f7f3717164223fc5bb3d902ecd12d5adf44c5a82186a440c7dc4e195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414575, "uuid": "400dc480-9675-4d93-b8bc-6fbf5ce7cf76", "comment": "Malware payload (RedLineStealer)", "value": "6e480715d0235633589f5071e57f4cd7b8b4bf22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414575, "uuid": "00181e84-466e-4136-9074-f018e34a4b6b", "comment": "Malware payload (RedLineStealer)", "value": "2ad4cc26f7601f83292c39a48a4ce404e482546a5ff2a4ad64d85a212ba82df8c60da6119d6a5357bde22ab9d326bdd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414575, "uuid": "1250a884-4303-4a10-be54-b80fd3ad3c96", "value": "T18164BF30A7E1C030F5BB12F549B98378A92D7E71AB3490CB62E466EA57346E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414575, "uuid": "0b9a2427-fad5-4e79-97eb-b4a719660470", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414575, "uuid": "eb1454b1-2516-48e8-ac0a-8ab4e117eb47", "value": "6144:7oojJvgNiCpj8ZLOtFH7h5WRhfJZ7XA66ybDIhaeFuRsftqFFO:7F94NiCpjGs35WRljLA66AFni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414575, "uuid": "a4689744-f4f8-4f83-9a1a-b39212962e0d", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414575, "uuid": "9c88eb9c-1be3-44a0-8b20-2f3fa78866e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414575, "uuid": "903ad689-5165-4317-ae46-285600bb9a81", "value": "7fa4c9662047092a7709c3537ae7ac30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2b26b8-25cf-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633433445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433445, "uuid": "10a00db0-1ebc-4a07-87ad-80478663b03a", "comment": "Malware payload (AgentTesla)", "value": "ef66a092cad6530312dd82159a433bf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433445, "uuid": "85903e92-9353-4793-bf11-90a8e992b16f", "comment": "Malware payload (AgentTesla)", "value": "86d52f7ebde10c9235629bf542f234d33ccfa5b771405c192ee080422b5a9868", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433445, "uuid": "eba9cf1a-896a-47d4-ada0-c23d9732f5a2", "comment": "Malware payload (AgentTesla)", "value": "96a0aeb5c7416c5ffd67b1d5a77cafcbf88f2e56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433445, "uuid": "2a94907f-b0a8-4d73-9beb-62effd8a60e6", "comment": "Malware payload (AgentTesla)", "value": "db2d5da538f8c11af0c109bd94ad2a0c14b56904e590e3039952a63178a39dbc043258fad192b0bd9d6f147f7be18b78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433445, "uuid": "66414aa0-c466-4838-baa4-517a6fcb93fb", "value": "T1B76423C2B6287105D57300F212BCDEB2C6D9EE12574195BE7B0AB045A736FB05D22BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433445, "uuid": "e7761c9e-2599-4f03-a148-c6680f8245e4", "value": "6144:qL8QysFYi4wkM1v6Mo3LQpFHfHKios69Z1ZU6kdYTIM47uiTiSx2loLm:qL3V2tXevg7oHfHKiy7jkZhzTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633433445, "uuid": "71a5baab-f587-4627-abd9-46bba666d1c3", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633433445, "uuid": "025c32e2-1e39-4a33-acd8-14c8367f19cd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433445, "uuid": "390015e6-011b-4c39-a479-79b99c7b6498", "value": "Order-06102021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e4ec1e-2602-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633455090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455090, "uuid": "9073a097-6c7f-442b-9e86-d7a60e06c009", "comment": "Malware payload (RaccoonStealer)", "value": "cbadcd873ab738c60ab7bcf9abbf07cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455090, "uuid": "13db2d98-e844-4732-a79d-a63f7270ddf0", "comment": "Malware payload (RaccoonStealer)", "value": "86e7826632a9f20a00c4c8fd6aeea2b9aa2d0d952eb33b339a052f91849f4d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455090, "uuid": "39e9d417-10c9-43a4-a7e4-53e9641d257a", "comment": "Malware payload (RaccoonStealer)", "value": "ec73fc6f79e3eb74c381b342df328c571493d6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455090, "uuid": "0ba15d63-7812-4d9c-aac6-eac94ebf6925", "comment": "Malware payload (RaccoonStealer)", "value": "9af369d17624277b4ad372cb396cf6b219d47127cfa56d8a90e62c7fed9b9cdd778a9ed0acd1b05bf00f00acc498d9ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455090, "uuid": "f27c9614-1ee3-4c38-8c9e-9045f26dedcb", "value": "T1DCB4F10067E0C035F4B711BE49B9C3B8A52D7DB0BB2491CB62D52AEE8A746E4EC71357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455090, "uuid": "f85deec8-75b0-4a32-9098-da890e5f9abb", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455090, "uuid": "bf56891a-26f5-45a6-942c-dd4347981199", "value": "12288:cvDC6S6zZM3W6sr3PQUwRFlqZynDSPWe9FFLo0IQ:B6SwMbipZynDS1Tq0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633455090, "uuid": "3eceb49e-9f74-4cfa-be8f-069261eefaab", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633455090, "uuid": "4c96cac0-d569-44f0-acaf-17d1def872d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455090, "uuid": "543a5443-f36e-4ebc-9bc3-d0b7e958ce45", "value": "cbadcd873ab738c60ab7bcf9abbf07cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63feec00-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633436756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436756, "uuid": "c1d33aec-d558-4d68-9e43-fc0d84885ca7", "comment": "Malware payload (Formbook)", "value": "23c11a847dc49090d21c11537ab93f76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436756, "uuid": "4f899e1f-5413-426f-a191-96810e388c4e", "comment": "Malware payload (Formbook)", "value": "875a2dbfb923d9d90fd51b8319723bc82eeb18f5dd4c58d9981c1b9976c51396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436756, "uuid": "98546297-a6b7-41f5-ae7c-2b28cce10b9c", "comment": "Malware payload (Formbook)", "value": "563b2ce8e43a2d5582d82975e4db2cc7bfcf2ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436756, "uuid": "759c708b-631e-44a2-9d5c-5469279c43e3", "comment": "Malware payload (Formbook)", "value": "ade3b62ba90c24398c10ce205cb13a20fb02ab9734a0672abca72ef2993a5c38710d01fad5c633ac4d53e93c88d1b476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436756, "uuid": "8d5b93b5-4420-43b6-bcc9-ac8858619b27", "value": "T1C4A4CF9433AF6F45EE349FF4241C509153BABC375179D76A0E91B0EE2A22B704EA0E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436756, "uuid": "f8b74548-6e58-4d92-ad88-770386ac2366", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436756, "uuid": "958a1adc-1505-4efc-a13b-98ea7398047a", "value": "6144:3KMWnHWlnhjQ+3HwOcc0W54HiDnfiUZhEYDThlOUjK22mhQrBJHejtis+QGgsIdy:3Eocc0W54HiriYLW922mhs3Gk1Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436756, "uuid": "0a4db7ac-5bcf-4333-98ef-5df4f807e7f8", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436756, "uuid": "aeef0bbd-c443-431a-96c3-de5749caf5d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436756, "uuid": "dd865aed-263b-44dc-9a79-ad827af04515", "value": "FT 10521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daec3c7a-262e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633474322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633474322, "uuid": "1681ad82-c0f7-48b2-8aac-614ca415fb6f", "comment": "Malware payload", "value": "11217b4db311c631c61bd7a56d94c7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633474322, "uuid": "48cb1f3b-9299-46ec-96bc-8e8ced713ed7", "comment": "Malware payload", "value": "876d9c40235667ad9182ca0357110a558534a1c7d672f8a636a966fe2d016eda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633474322, "uuid": "7f9ff04a-75f3-435f-857d-c0663783e7c2", "comment": "Malware payload", "value": "74af65201fd5334243c7acd564947f8e2c7d02ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633474322, "uuid": "243632bf-990c-485d-a748-2f37248746e2", "comment": "Malware payload", "value": "4c30dbae49275a07c1fe18c8585d7f5e2780ad2333619af593550fc0a0b7f466855cfdc7f699d227c3f65ce1f8107eb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633474322, "uuid": "f2b0f9a7-cd87-471a-9796-036e8ce91ef0", "value": "T141D4AE693187DC41CFA55FB2C88F815407B9AC33A166CB2A7AAF32EC25123F25C455DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633474322, "uuid": "006e064a-abcc-4d18-a825-34b52063e6f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633474322, "uuid": "810b654b-de9a-441f-94df-75f96f174514", "value": "12288:MHXUTG7Mblp/FGqovc0WDyaO/S3pcqsXh0es934/lsp:MoLGqic0WDo6ZcDh0enC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633474322, "uuid": "f4df2cbf-fb37-4f3d-ba64-d926d5d21f9b", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633474322, "uuid": "30348ff5-ec73-492e-bf78-b8c0514f2eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633474322, "uuid": "0981022d-e611-439d-a75c-128da1e6ded8", "value": "ypQMs3zgtBPGcfu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f35c90-2618-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633464621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633464621, "uuid": "60ba1d8e-4e8c-4bd6-bb0a-46987cdd07b2", "comment": "Malware payload", "value": "a407a9e919f37eda0b74df064a31a843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633464621, "uuid": "7134e262-774e-480c-81e7-c2bbfe2ca4ec", "comment": "Malware payload", "value": "8881bb086bc2b6a89b09a8fb1d72458a34a5457ab073ddb14c3ead6e2ec65a8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633464621, "uuid": "0d32b904-504f-48dc-8b30-904c4237a294", "comment": "Malware payload", "value": "04191da2670b4bc4ef5db5dad14441fd154b35ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633464621, "uuid": "51f0fe86-08c9-4e60-8367-3d4249b39d9a", "comment": "Malware payload", "value": "131b454c0da8bb27fd18cb5f47a5fc68f95103496f6329de3003fefc8dfe76fe22805919da135650f6cf73fdcbcd83ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633464621, "uuid": "1fa09e76-d906-499c-9af7-d0f4f1aae846", "value": "T18EE4BE60B743D517CE7547B028EDA700633AAF211649C32E7898B6BC2D73B741A9CDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633464621, "uuid": "23c7cdd6-9cd2-4ac6-9789-5b1e5d6958c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633464621, "uuid": "6b1aae73-0f40-4eac-b2d8-5888faeb407b", "value": "6144:uFYWhQ+3HwOExxyx7IzAaD9Dqvx5IvPWQsy/4JQGSp50IJjvYF2+qipQ+9afvtJP:7oL7ABDIvE2Qvbp50ivKvqCQeY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633464621, "uuid": "f69d7d74-f3cd-444e-acdb-977dfa9ca4e6", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633464621, "uuid": "e005a0dd-b348-4c32-93c3-b8a351577987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633464621, "uuid": "44309205-7730-45d1-8739-bdeb7bfa0450", "value": "c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e6e836-25f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633450430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450430, "uuid": "51ec01c8-9483-44fd-b66a-669999a615ea", "comment": "Malware payload (Metamorfo)", "value": "9774f27d6d24e923fc427ffa1a13b843", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450430, "uuid": "c581923e-a116-4191-8509-cbee9c77a4b0", "comment": "Malware payload (Metamorfo)", "value": "8b906b8a552f85d6d5cc79f2416adec2cb935607b4ab27636f23cddd53320cf4", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450430, "uuid": "cef40701-bba5-4be6-bc61-25132b75a660", "comment": "Malware payload (Metamorfo)", "value": "23038588cbaeec99dffca57bd16612032dad31c8", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450430, "uuid": "7914b001-c6c3-4fb8-b428-28f8f6c9b407", "comment": "Malware payload (Metamorfo)", "value": "203e2c95ef3af507845dbe2ef51d8f17572740c3d31fa2a7ff6ba7f643995a2832702acfab9f6be7be62faf138f1bfb0", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450430, "uuid": "876b0979-578b-4a04-8723-c1a938d40005", "value": "T177447D06B3D5437AE4DB07326B8B93628A72EC788673412B1249750E3EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450430, "uuid": "298640bb-893e-4b54-a780-ba4a0388d070", "value": "3072:omUWC903DaYIARwgz88ereWn/7w05g0+McB3RUN46ILJ9+ZB5yOanj1:om53DaYIAs8er1nzTLrM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450430, "uuid": "acd77937-0bf2-43d2-a7f0-85aa3301a04c", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450430, "uuid": "1fa0fd6b-c1f0-49f2-81a7-d9a8096eb39e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450430, "uuid": "5089e713-a250-40f9-9716-33fd5f5cb398", "value": "9774f27d6d24e923fc427ffa1a13b843.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de64f64-25aa-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633417284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417284, "uuid": "27cc3f67-86ab-433a-85c9-670dbfc628b9", "comment": "Malware payload (RaccoonStealer)", "value": "097bfd5566b87593e96d59d16424e045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417284, "uuid": "1f58f5ac-33e5-44f2-b9ec-d9c38c2146b6", "comment": "Malware payload (RaccoonStealer)", "value": "8bdeaf6acc5c6f170f2983e8730893a7c268196a87bd4c044823ea1b78a753c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417284, "uuid": "6b7352df-7f63-4ac8-a223-4fd8ec23445d", "comment": "Malware payload (RaccoonStealer)", "value": "2a3b1359aba7b1fa0651875143f16f8baf5d2a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417284, "uuid": "54e7f8d3-cdf6-42cb-9a6b-08a63a4f4798", "comment": "Malware payload (RaccoonStealer)", "value": "9d08a71ab651e9a99c0730282ec5b7ad7e810fbdb10c7391e3b1780f256c0718224d1903bfed8d082c2e9c9ec0f3c2ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417284, "uuid": "3294140a-fdf1-431c-9007-1e26132784f1", "value": "T1A8448D30A7B0C035F1B712F449B593B9A92D7DB1AB3490CF92D11AEA56386E8DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417284, "uuid": "b77c0c34-c1ae-4650-a917-9e18929b7746", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417284, "uuid": "56d91362-b103-4998-bb07-f122d7aebcef", "value": "6144:so1gJvgPtv+zV9TOKC7is8Ywal+PSLc5WX8Y87iCbMFO:sc+4Ptv+zDbbs8YBQPV5WX8Y9CbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417284, "uuid": "d3778cdf-ce2d-4cc2-b784-4a244a15f7d6", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417284, "uuid": "13dadbf9-8521-4f59-ab69-c76b01ad3866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417284, "uuid": "3b0ea5d4-4e6e-43e4-90f4-d8fc7407d7cf", "value": "097bfd5566b87593e96d59d16424e045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce40f16-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633411780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411780, "uuid": "180c780c-97b4-4e21-9e6d-9581f2358652", "comment": "Malware payload (AgentTesla)", "value": "e4e38ba531e4f7757f12a466aa88a92a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411780, "uuid": "386ff3d5-addb-487d-987f-6044f8ffc115", "comment": "Malware payload (AgentTesla)", "value": "8c5ba3bb03e618141579283f781798366c322106055a0a40291d9d8d36e0a218", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411780, "uuid": "28163c8f-6f62-4f84-adfc-002a96675e0a", "comment": "Malware payload (AgentTesla)", "value": "75ccc405b3d165792b0270bc26cde968ca3c6873", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411780, "uuid": "a1ff7f16-b0c9-4d51-809d-1728c9d8cb66", "comment": "Malware payload (AgentTesla)", "value": "46ace8532dfb3769fe6cad4797130843b4c2214b53cc77ffff0097e37e4c8834fd75da76466e8f468ac54cfac0a02535", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411780, "uuid": "cf3dd865-14bd-4290-9065-ef18d82313cb", "value": "T104F4DF60B743D517CE7547F028EAA7006339AE111649C32E7C49BABC2E737741A9CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411780, "uuid": "c2bffda9-e762-48c9-84c7-5dd3983636e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411780, "uuid": "210ef527-49b0-46a1-9ad1-5c2d93ec67ee", "value": "12288:RoSHvMq8+v+1zv8AICJcw9+d3o2Y6ieecDbN9:RZ8+v+K++d3kBqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411780, "uuid": "6a6b9d2d-917e-4287-a739-48085c81ef7a", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411780, "uuid": "e7c53923-718a-4a0b-8c29-9be8fb69fc38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411780, "uuid": "476a3dc1-8d13-4393-b3a1-e3b1537f488b", "value": "DHL Shipping Documents REF - WAYBILL 44 7611 9546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839618d6-25a6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633415764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415764, "uuid": "780486cb-a4c9-445a-9ffa-4b6261ded5f9", "comment": "Malware payload (AgentTesla)", "value": "fe04506591094b6fa136ff4ccfcbccf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415764, "uuid": "cb1ea80d-8680-4ac4-8168-8c9250298d57", "comment": "Malware payload (AgentTesla)", "value": "8c7b2a9de0c292079954b1a378f65f5bfd81c5fda14304c4dac51271f7af50a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415764, "uuid": "2f16654c-d2e5-4b5b-8f7d-aa079b836c0b", "comment": "Malware payload (AgentTesla)", "value": "dd603213fc9fb06811897bf8f331abafdfa5c9dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415764, "uuid": "5600a21f-e8ca-4847-b68b-008c01f75d71", "comment": "Malware payload (AgentTesla)", "value": "460d82a34231f6132dbb42729ffc4678da3426f28b3ab971b7c30665483d9b8a172dbda2f5b77a47fe09874734ff7dc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415764, "uuid": "c0e0a720-9e7d-47fe-850f-0f660094862c", "value": "T1CE05289453CB98C0F13B2734B0222CFBA47D6B0DFBAECB1151573A97CCB9658561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415764, "uuid": "8e3d75a8-9219-4155-9ff5-cecc39f2712a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415764, "uuid": "6ebba50a-50ac-4549-9e65-6e861bd9f7d9", "value": "12288:V0fDI046Mnq0UnsO5lJkKzUvoPUu9YCFHyL2WOYELIqEUjrlyFkJ/vqz7HYob:GBZYCIqcSJ3qz7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415764, "uuid": "03c40bd5-391e-4cde-b54e-0365d001f1c2", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415764, "uuid": "964a5cb4-340c-443c-8aa6-8bb28b5cd3f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415764, "uuid": "4f63d271-59ae-4338-96f2-3814e7e63ded", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed54883f-25dd-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633439564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439564, "uuid": "553a3eb5-cace-43af-818d-d60f89967d5d", "comment": "Malware payload (AsyncRAT)", "value": "59921d02db3b8cdb6a293cfc4ba0acf1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439564, "uuid": "819d84e3-59fb-4111-abdf-9f2c0c135bc6", "comment": "Malware payload (AsyncRAT)", "value": "8d87c0f9ca64bba08ba818b6910ca84623ac53931aa0f00d0b85367990e0c11d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439564, "uuid": "e0173b87-459a-4de9-bf69-6ae21a052c22", "comment": "Malware payload (AsyncRAT)", "value": "ba2db3254521f8b0840c04606433d88ec431e030", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439564, "uuid": "3313af23-0869-4dc2-a711-97a7d6f37b5a", "comment": "Malware payload (AsyncRAT)", "value": "f7291fd7e9fc32c6a766f6784e79ce49bfe5fff5cebd0cacfe85550decb56201c387d211dd37d751d1c8b714fc1f504e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439564, "uuid": "bb33c196-a5eb-4692-aca1-f5b26c2b7371", "value": "T1D7B472D053CB99C4B57B2539B0222CEBB47D630DF3AECF1151A73A938CBA750561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439564, "uuid": "92887191-7879-4378-b0ed-75673e89650d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439564, "uuid": "a204e516-151d-4cd9-8340-f95eff85538c", "value": "12288:FI5I046Mnq0UnsO5lJkKzUvoPUu9Y/Ba7yt8+BnLtMLwadEzb:gUBa7T+BnLtMLXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439564, "uuid": "804ffbe0-33a0-465c-a4d4-371ebf72befe", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439564, "uuid": "f6a6c342-e608-4905-b219-91b14127dd24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439564, "uuid": "b01fdfc6-c1af-429f-98a9-4a46cf6a882e", "value": "SOA_SEPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d97fc5-25a7-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633416095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416095, "uuid": "a7ef353c-c288-4d92-80b2-f4832093ce4d", "comment": "Malware payload (njrat)", "value": "c7b942aee6ebe5d43a3b7398eda1f0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416095, "uuid": "0bf3deda-1c76-4a8d-a790-b61b4fa8c006", "comment": "Malware payload (njrat)", "value": "8e8732b9bebc8382e938b48697e79feb4b06528df41fd855b540dce788f6d8b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416095, "uuid": "2de901f2-965e-4624-b3c0-50c7bc3f4d1f", "comment": "Malware payload (njrat)", "value": "11a0690bd6158cbcc5ddb55282751689df0538ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416095, "uuid": "43968a50-e1a7-42c2-881b-6abd4870887e", "comment": "Malware payload (njrat)", "value": "62d6173c1eeb1e312ba15525ffda4a3ae25b6505bc1bb19d91569961e5c5751ce609e78c62e2703f915e99c41509cd41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416095, "uuid": "469df6b7-59c5-43f1-8da0-68d69c3d86f1", "value": "T17AB21A4E3FB98956C5BC17748AA5965003B091870423EE2FCDC564CBAFB3BD91D48AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416095, "uuid": "cb0e5666-5b17-4ca7-a7d0-f6bb2aa934e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416095, "uuid": "648962d2-f0f2-405f-92e6-c932bb004b9a", "value": "384:qc6ze6e1PAhJVzC3tC1im/Bs+x465gZ0rap9HBmRvR6JZlbw8hqIusZzZs1B:qe9EJLN/zRpcnuP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416095, "uuid": "8bae0e45-5c6f-45ae-b914-eb556c4da0db", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416095, "uuid": "c5b8add6-5edf-4322-9e6f-65b2b40771df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416095, "uuid": "2f216d1b-fb5d-411a-a7a2-ae4abcc5b06b", "value": "8E8732B9BEBC8382E938B48697E79FEB4B06528DF41FD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c10f76-256f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633392191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633392191, "uuid": "6366ee8c-9acd-430f-a5b6-f8e02ed92121", "comment": "Malware payload", "value": "14f5cc4955bba1b6d57d44f0c9118d04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633392191, "uuid": "20478304-d6d9-433d-8273-c7308616f01c", "comment": "Malware payload", "value": "8f3cc71ce6174d0475964d1d4f5a60880c9159de5da5fad804595e02d138fb74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633392191, "uuid": "49478b68-f7cb-477d-9f0a-18fae0315707", "comment": "Malware payload", "value": "5ee1e72f1f7c7881eacb39615dff3d8b49ef7c52", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633392191, "uuid": "831da9da-b654-4bb0-a6ac-ef70d371cbfd", "comment": "Malware payload", "value": "c7a6c8316c69d1e61e76597034a4ce232f3522f7c795aea0fd4c52617ca9883e4bf540520bdf96467afa232615f0fd44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633392191, "uuid": "784601cd-db26-4223-9273-c77da14e88b8", "value": "T100732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633392191, "uuid": "5d3903ac-8115-499c-9b56-56c2106ef3c5", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftcUnA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFOKA5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633392191, "uuid": "666122c3-828f-4241-bb40-ec775fb74f6a", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633392191, "uuid": "438f8445-278a-4a32-a576-071aad2b9160", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633392191, "uuid": "e0b245a4-b55a-4b64-ae43-74a84b209f36", "value": "arm7-20211005-0003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f2d49d-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633437811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437811, "uuid": "4bb76625-7104-4659-8520-0ddd309ba0dc", "comment": "Malware payload (Metamorfo)", "value": "391800b419bebbaa3dcca11f64cf2e20", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437811, "uuid": "1710fabb-502f-4670-85b6-913603c9efea", "comment": "Malware payload (Metamorfo)", "value": "8fd4a28d6615407181697b7c61c73e534048b11017a6abc855c4bbc32a6f6782", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437811, "uuid": "6e66e964-2636-456b-a934-854b577977af", "comment": "Malware payload (Metamorfo)", "value": "320d02d00b6808c4d61d3496ae65754d07b66199", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437811, "uuid": "fe98e458-769e-46fa-b997-5b6f2937587e", "comment": "Malware payload (Metamorfo)", "value": "ab61cde081e3a740ad472cb497552c7053f34f2bbc347c717563ad81eb2bc01e2a8463334a991f9e4f39d124c9e002dd", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437811, "uuid": "6137ea73-4fbc-4673-956b-0479dad8db9c", "value": "T1DD31E1051AE61329C3B3CE7A10B7A2038A76FC51AD934F9D80C487DE1851054FC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437811, "uuid": "48b59055-b2cd-4905-b4a0-bf6e5c058c37", "value": "24:8+JUHRlVo5kcbA+P2kEr+/P+PZdMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+O+kk1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437811, "uuid": "cb2d91e7-9323-41cd-aa06-e16e42b37528", "value": 1574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437811, "uuid": "a882dbea-5373-4511-a475-c2a568514c64", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437811, "uuid": "165d0845-6dd8-4f2c-a53c-265a07e84e10", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075e935e-25ff-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633453781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453781, "uuid": "284f1d3e-9038-4b01-9d08-d9d343a3164b", "comment": "Malware payload (TrickBot)", "value": "814f23c82d146a779dcf8cb1f2feec0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453781, "uuid": "1563fb3b-5a13-4423-8881-09836f36a39b", "comment": "Malware payload (TrickBot)", "value": "9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453781, "uuid": "9390bc83-94dc-4b69-a201-d7f68d2b7b61", "comment": "Malware payload (TrickBot)", "value": "4b5e5fcff0ec39af8a97d99f285a8d005d54fc08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453781, "uuid": "0e192454-ef59-4c23-ad16-2bd0b6f086da", "comment": "Malware payload (TrickBot)", "value": "2c3486217f3c795df775dd9a9b9a309864f09316540457d05b1c45251792afbdf6738001207d10df381b6ebf3f996395", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453781, "uuid": "c96cca88-c41c-4c93-988b-f1f8dbf3f5ad", "value": "T111A4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453781, "uuid": "0e3c648f-45e8-4427-b516-ab6396e807c1", "value": "f34a0f23e05f2c2a829565c932b87430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453781, "uuid": "2d9b7469-80f8-4ecb-984f-50206ac9f703", "value": "12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Klls:bEKNb/aZl6KdSrs+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633453781, "uuid": "df77b337-e74f-4424-acd3-69b30fc54a07", "value": 487551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633453781, "uuid": "057432ac-1740-4b08-9a32-0968746f9dad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453781, "uuid": "314fadf9-8f40-4cb7-8320-cb058c0c743a", "value": "814f23c82d146a779dcf8cb1f2feec0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793d0c5b-260b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633459126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459126, "uuid": "f81b225d-2ce9-49d5-a80c-5ed9afb324fd", "comment": "Malware payload", "value": "301162a7d36267688351ae32ce6326bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459126, "uuid": "a722cadb-4863-432b-8099-801bfd658ceb", "comment": "Malware payload", "value": "906c931107ffb66c345dae2afa253b71ff21ae420348cc44f36de0bbe3921386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459126, "uuid": "dd79e73e-d1dd-4486-9b29-04a1141a106e", "comment": "Malware payload", "value": "056645937b938d0845d03ffcd5890a13b58772bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459126, "uuid": "ecf9a55c-bafe-493f-b7e4-1340c4d15954", "comment": "Malware payload", "value": "1fdaea0dbb7cbcd31f79c96e33fee971aa776980556f09ed53e9d5efb7d6fa65188aedf1853979ac3de159774156b8ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459126, "uuid": "db5446b4-93f0-4a93-bff0-b9622342cbaa", "value": "T13B35020B77079516C82497B6ADF3BB6027909FE698628703DD7A325DD07E33A6C0C792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459126, "uuid": "b23b635e-b997-49f7-9943-50a65840e6db", "value": "24576:7eGKIf9cVNejVLs9PjklPTOvPg3KFeCv/tPdcLhV9TC:YTcVLs+l7QPgseCHN2LhVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459126, "uuid": "ab01f75d-a788-4f68-af24-97ae90ec17f1", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459126, "uuid": "2451aee3-55d6-491b-85bd-8df5c0a3a1c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459126, "uuid": "f329d2ee-3532-4509-b1a2-13cdd9d8b458", "value": "301162a7d36267688351ae32ce6326bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792dda6a-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633454401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454401, "uuid": "00dda173-ef40-4339-b23c-b1e402c30e97", "comment": "Malware payload (DanaBot)", "value": "21d57f314016abccc635b26d1a238042", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454401, "uuid": "a83a0a36-4a6e-43b3-ad82-dfa61ff37dbb", "comment": "Malware payload (DanaBot)", "value": "9096790ce75881a07a3751c611612f9a30fadc0481130c0cdb3562af4ec39b92", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454401, "uuid": "7a43593d-a763-4404-986f-bb240a266e02", "comment": "Malware payload (DanaBot)", "value": "46836ed0c6500a096b3c3db77939b39d47e9c991", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454401, "uuid": "d35d6571-8f28-4a2d-912a-f436655aea9f", "comment": "Malware payload (DanaBot)", "value": "b1b0c6fe82631c7b72ffd7094f6bb35f0d13248c2687c6f733ca837f7c2847d9db1dbae8b3faf1955da2079a5a931334", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454401, "uuid": "b304c2ee-eef3-4378-a5bb-8a07dec70887", "value": "T174351210B7F1C035F8BB13FA44BD83A8A52D79705B6894CB72D217E99A38AD49DB0353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454401, "uuid": "f8e356d7-ad3a-4a90-bbe5-01162ad80c49", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454401, "uuid": "89315382-e8d3-4970-9788-9cab69b0259d", "value": "24576:g6ew4piY1fNs2TV0WUZEe/07a7o4zO90lppmuWcsHZ41/p6c3:cN1fNs2TV0gq07aMF94p9WcsHZIRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454401, "uuid": "e8486b46-46a2-4b34-9f21-1bcf3bb4cc48", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454401, "uuid": "f2a6682c-d4c4-4c4b-9861-1df81d284404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454401, "uuid": "ea5c1ed6-8081-40ee-8708-d0cbe4118cea", "value": "21d57f314016abccc635b26d1a238042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e372071e-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437829, "uuid": "04480e7d-c29f-47ed-bead-abe342607bc3", "comment": "Malware payload (AgentTesla)", "value": "776ce735557ae77f4549c92f31896c30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437829, "uuid": "c47c1745-ea20-4c70-9dbc-28255f07537f", "comment": "Malware payload (AgentTesla)", "value": "90a18098b6c63754deb924cdd4d25c780d948bb64965dfd89789a0da7fb04ba7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437829, "uuid": "4d19aa09-20e7-408d-8b5c-91e7ca772b3c", "comment": "Malware payload (AgentTesla)", "value": "5e3b13d3c7aadde1c1d080bc77808f0c24e0e6e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437829, "uuid": "daa8c125-f9cd-4ee7-a514-263664c46f4b", "comment": "Malware payload (AgentTesla)", "value": "aff65ab6d8e18d633caca2431104324d629ef3dc7c0e7df1651191f57bdd70477747c36ad439deb47a81a681c8d17dbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437829, "uuid": "dd9998a1-a72e-4e02-b62a-b998d7540d73", "value": "T11AD4CE25221B7F05DD7C4FF7984CA99083BAAC3B952AD37D1DD171EE2962BF80580A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437829, "uuid": "c1ee233b-7d17-4286-971a-5e1cffb10009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437829, "uuid": "42bc1b9d-93fd-4a1a-abc4-ebd2f7feae16", "value": "12288:qfFKIp4tfjz0cEC8eiH9c0WE2r8s39X93nfKnyn7kCxzQjRZJIJ7to:2KIB9c0WvtN3ic7kCxG+J7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437829, "uuid": "5cdcd215-a2ee-48ad-9f3a-6e9ab24f5f46", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437829, "uuid": "282e96f5-53ff-46bc-9909-8f42e71b4100", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437829, "uuid": "8234acbd-6ae8-46ed-a01c-9d0459d20a22", "value": "P-O9478384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e396b329-2636-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633477773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477773, "uuid": "086c5dbd-185e-49ca-956b-6545301724c1", "comment": "Malware payload", "value": "0386b5e91eb6a34fee03c04712049cb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477773, "uuid": "beaebaf9-16a6-4615-bf90-6b959f738271", "comment": "Malware payload", "value": "90de3262186aa349aa3a0069830f803ada26573a8f3a4a392ca1747346e7b191", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477773, "uuid": "5157b257-3695-4cea-b320-96a208875e86", "comment": "Malware payload", "value": "35b87220f470af82798a5e20bca696dd7c963d76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477773, "uuid": "c768ed3f-66a8-4b79-97a0-a15caa269b3b", "comment": "Malware payload", "value": "021bfdf25cd929158d2e0529d1eac542b948f3e64c85d561272f96afe07d1def99df4118c99c7387ccadf180ef4ba4c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477773, "uuid": "38738cd9-4966-457b-b354-b21efb7f5da3", "value": "T16844BF2175D38AF2E66786307AE1C7B087267D5D6A32B14F37E1271F1E3C6E18A61306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477773, "uuid": "ad2c28f9-a923-4dcd-8c7c-0fe6c818e614", "value": "35a4f2810483d7186fd90e5ce794e1a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477773, "uuid": "540aa402-fefd-48b6-b89d-228a92a6e11e", "value": "6144:BkOl23/4NbQQa409lZq8ygHWSn0zl19pDJ8:pc3/4NbDa409LZH5n0B19b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633477773, "uuid": "0db3b905-0fd2-483a-a71d-37e2a715bb4b", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633477773, "uuid": "19cbe204-d62a-4578-96a6-dfbce0642532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477773, "uuid": "35d2de95-1b53-4d75-94ab-ee199858dc0e", "value": "0386b5e91eb6a34fee03c04712049cb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec626b39-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633441280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441280, "uuid": "af3b6bab-1f2c-4db1-a77b-51ca08451521", "comment": "Malware payload (Formbook)", "value": "b49ae4462f5ed9597f6f3646091c707a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441280, "uuid": "7be44d13-7976-4fc9-92ab-d6c004afcc2c", "comment": "Malware payload (Formbook)", "value": "90e6f10a0caabd250a9d43d12982b5861ec160177d99ad07ce68bd18d103736c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441280, "uuid": "7a7936d9-32ae-4932-949e-788d161d2968", "comment": "Malware payload (Formbook)", "value": "0346b7e8e054c151735647d469f265028019bd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441280, "uuid": "cc516e4d-7451-4f73-ad75-0ffb0ecde585", "comment": "Malware payload (Formbook)", "value": "ab7d45e08e2d124da1fbad38923a87afe5039799208ee85dae23cdf3c5ffffe45d819c26cd88d28b2bef6006e34a08fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441280, "uuid": "5eeeaad1-bae1-427c-9a17-6bbdf6232b87", "value": "T149B4D09433AF6B05EE348FF4185C91C253FAAC3B117AD7690DD1B1EE2922B704B51A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441280, "uuid": "0b06168c-137d-4579-9097-df8e003c9ecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441280, "uuid": "1916459b-99dc-421e-9b29-3461da28ca79", "value": "6144:nKmCLXDlnhuQ+3HwOcc0WYHMTZPPPO1/E9aPEUEN75kpr4j6lrG1yXUKqLe:S3occ0W1TZPPPOlcU675WlrGwXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441280, "uuid": "35dfa0c9-4b86-4560-a66e-5901deec127e", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441280, "uuid": "38956036-ac4e-4a20-b9f2-7b95e738ae66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441280, "uuid": "c910f991-abfb-4fae-975e-04d803c581e1", "value": "6HGB5SHl8XtnFWx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0088f5ed-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412108, "uuid": "2ad9edba-af05-4d34-9a6f-a1a9e951d13a", "comment": "Malware payload (Gafgyt)", "value": "42421dc7bed8a2723b4b243355ed78af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412108, "uuid": "0f81ff22-58de-4609-986a-d9182beea47b", "comment": "Malware payload (Gafgyt)", "value": "91600f0ab69994ba2029a971d9794aa7b3e0c42e1bfbb7f4e1e80373ad25d8b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412108, "uuid": "f10eb0ca-fed0-4539-b1a7-384b187d02b6", "comment": "Malware payload (Gafgyt)", "value": "0778bb29739d09c95613c330974d5efea24fa87e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412108, "uuid": "b983454b-c4f0-4314-b722-7a80ce5616bf", "comment": "Malware payload (Gafgyt)", "value": "bf223a72dcaa323b36cc87d897b46c4f9635b899a2c3a09804c5f99d984a73638cf0c7bb4cb2da768e974ee094029d7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412108, "uuid": "4fd34e6f-4e10-4f64-aaec-f789a8c0aff4", "value": "T11FB31901D5508B67C2D2277AB7AF425D37232B6897DB33125A247FB82BC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412108, "uuid": "7849d3da-5be3-4469-bee2-651922da2a4e", "value": "1536:sgnZFHzhI2aD+YTMabi1ZYCt42hUcJ5PQUeY3XDL3BcQVMhy+abmwvQOW8fXGMN:xZa5sYCt42hvJ6XIXDdMYbmgQOWsXGMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412108, "uuid": "f7cde65f-9c9c-4d3d-97fe-e2945670c4e9", "value": 115202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412108, "uuid": "f050fbf4-71ab-484d-a315-654e5c4ecc78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412108, "uuid": "6296032f-8d80-4a4a-978c-4ded3e48ccc1", "value": "42421dc7bed8a2723b4b243355ed78af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b6c49f-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633442015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442015, "uuid": "1bdce510-5c35-4d79-87a6-5cd35c787c04", "comment": "Malware payload (AsyncRAT)", "value": "23f1cb46f58dadd81788b5c279dc997f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442015, "uuid": "e14af1fc-428c-403e-bb95-4c90be0353b6", "comment": "Malware payload (AsyncRAT)", "value": "91d07db42921a9ffe88f14cc796ae63454267d252acd7a528b6a2e4ec327310d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442015, "uuid": "119986cb-ffe6-457b-82b6-26e16cc123f3", "comment": "Malware payload (AsyncRAT)", "value": "e89fd48882988066bb67e5a55ae1ec54d689dc20", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442015, "uuid": "326d34f6-472a-45d2-824f-eed9671f462d", "comment": "Malware payload (AsyncRAT)", "value": "e26feaf788aaff1ca764d5eda27a82a98193b3c206979ff6ce3a7f281dff86cb8b87c9f15a3821834a1ce196ca8882f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442015, "uuid": "0a348f8b-ec8d-4d92-9416-6144a7c804f7", "value": "T1367343C90E84CAF026CB9A6F93E96D92683E35FD28FD9CD1C942D162063177C178B54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442015, "uuid": "e4c3ff78-5794-45ed-ab0c-35386a551093", "value": "192:Pl66nqJJr/nlmmrj/yJR4jr/WnuXqmq4lkonmU4ym4mnui2lJmlrjkRrlkJr/XyZ:OMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442015, "uuid": "9532bd27-ce6e-4664-a2a5-62f8d6dc8437", "value": 77399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442015, "uuid": "b03c9207-5c97-41d2-8159-f62a6b21530d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442015, "uuid": "4feb8b95-5504-4316-abbe-19796c7ec4a6", "value": "Charter Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0203565d-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412111, "uuid": "4ffe717d-30f6-499a-b8eb-3b86b68920e6", "comment": "Malware payload (Gafgyt)", "value": "3b062cb3282807fa8e4a67a482ccd09e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412111, "uuid": "02753f55-1bd9-43ce-a8d1-62b5276acece", "comment": "Malware payload (Gafgyt)", "value": "930cf23b18faf9a111096919eb53340cd581837252f9d2a95536da3b8a21bf51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412111, "uuid": "ca302c37-99ed-4fde-b8c5-65fd17ec9c2e", "comment": "Malware payload (Gafgyt)", "value": "ac23c861a6e49bc5e8a6be0b487f5ee8013121b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412111, "uuid": "fc151557-7181-4b94-942d-c468bc7ed4a1", "comment": "Malware payload (Gafgyt)", "value": "4833515653fc4243a982f4bc41b2c536c3ad23b5890048f6cb42ed36574ba6c0a2d67b976780df1bb8e1ecd2a9b7966a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412111, "uuid": "a745fa56-b704-4f43-a96a-5f3bb37fdea1", "value": "T1BF733B42E753CAB3C8430AB513AB9A664932F83A4E2B9F45F31C7DF49B524C87217365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412111, "uuid": "fa04445d-4e8c-4578-8948-5511e298eaa5", "value": "1536:D/e9hSvyrxWy0N+/WkngmVu/Nu6LMKyLnAmLItVOCjXZRshS:K9EvyQtiWkngku/DjKAmUtVOCbZRshS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412111, "uuid": "9e4b6d33-af2d-4266-a30d-0bdad0db6e5f", "value": 77490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412111, "uuid": "53e353f6-ba26-411d-ad7b-c8d07c3ae1bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412111, "uuid": "96ddce4f-5aff-4c75-932a-a7ba19a3efdb", "value": "3b062cb3282807fa8e4a67a482ccd09e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6020e5-25fb-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633452477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452477, "uuid": "a01ec4c9-fe9d-40c2-90bb-16df45889084", "comment": "Malware payload (AveMariaRAT)", "value": "24273d15847409151e621949d6d1f45c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452477, "uuid": "27472fef-a55f-4499-be97-d8cad6b3f1e8", "comment": "Malware payload (AveMariaRAT)", "value": "932d5ef35aaa8c8c802fa14326ca63e80f3cf2bb7c1a40d52d343f2fc63efc44", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452477, "uuid": "eb8cf71f-7b76-43c3-8cd5-02be20280cd5", "comment": "Malware payload (AveMariaRAT)", "value": "c1f4fa43e048a44b8b3d48858f8662589e4ea9cf", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452477, "uuid": "0a2125d8-5a43-48d6-88d2-7ea5d948047e", "comment": "Malware payload (AveMariaRAT)", "value": "f46cc1225645dc1475c842fcb3e7d39774da475eebc5fc7c4dee1e51fd99121b0bd7a4d48bcc15a3d0ffdbc4c992d796", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452477, "uuid": "6a1b1f06-9eb9-44bf-add1-9e8563e4e664", "value": "T11E950A10B3A15124F9F767BA76B54694883E3C801F2DA2CF5A850ADAC62D2F47C347E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452477, "uuid": "40ad501f-7e21-4510-bae4-b76906704037", "value": "59db2621db4bfcbe475ffe9303a1d051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452477, "uuid": "94b01b5a-e62e-41fa-8c6d-a439ba8489c1", "value": "12288:EGxLdGXOKiiEuuOa3A4nRPCWCimrlsQR4xD4pa7+oy1Z4e:9RGXgTRPCW5ElPCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452477, "uuid": "882d272e-1c63-4af5-9bde-e90587d742d0", "value": 1948672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452477, "uuid": "4e7980d0-b307-401e-889d-9ea476d70b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452477, "uuid": "b2f5afc1-a674-473e-9c17-b8ef872404dc", "value": "Naujas u\u017esakymas. 141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accf6fab-25e5-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1633442891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442891, "uuid": "aaa1f054-1119-4c1a-a5d1-2997d9e365bf", "comment": "Malware payload (SilentBuilder)", "value": "93228553f3055dc40e935e05c6491889", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442891, "uuid": "61f57b41-179a-4638-b7b6-a8ef67d21813", "comment": "Malware payload (SilentBuilder)", "value": "938e2c76b7cb5805b297b2c6f8ece0f8e43c854639bec1a3decc78f1cf74bd1f", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442891, "uuid": "ce54caee-aa50-403a-8d5b-4d3945c7e999", "comment": "Malware payload (SilentBuilder)", "value": "a96f7ba8c62913b8db220000211789070624106f", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442891, "uuid": "4c5feb02-4d04-4699-bdad-2e43de2f69d6", "comment": "Malware payload (SilentBuilder)", "value": "0b3d89dfdd5717f49c453cfed7a506ad2032ce9b3f67319fcdd8ccd3d7d8c31e59967fa03536cfed5ea3ffcb6c3c0474", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442891, "uuid": "6decb36c-4e18-4d40-9219-1c9ecdd61110", "value": "T15034E04AF575C84DFE5AC73A4CCB0F9B5276DC128BAF0246B685B1515EF0DB82A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442891, "uuid": "de1ec85b-b6b9-4656-8377-76c0013442e0", "value": "6144:6Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgl9DW/cZZRBDq1JOb7AvOsPDMlovS3OPI78:J9D1TDmUb7AvDDy3fLvfv1O+1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442891, "uuid": "30163103-e8d6-42d6-a284-69b912df57a3", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442891, "uuid": "24153839-e46d-4d7e-a147-05b818cf3989", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442891, "uuid": "f28812fa-73a3-4c77-bbe1-74de69ccc47b", "value": "doc-2131577926.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c770b67c-25c6-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633429622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429622, "uuid": "2de73530-4be0-4ec9-bb73-59d479cb684a", "comment": "Malware payload (BitRAT)", "value": "20ed11e944ee0625399cb7762aa60255", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429622, "uuid": "6d3da597-f011-4ccb-8537-d337d692e4b2", "comment": "Malware payload (BitRAT)", "value": "939b9ae2b1804b707eafe1a369b98096d9c3eb33de5554906c5a5f64d750d4d5", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429622, "uuid": "b00762c2-636d-4c9e-ab0c-95d8ddb6d6cd", "comment": "Malware payload (BitRAT)", "value": "cd82bdb5b4d9520ecc1b0c4e99d19937a29cbfdd", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429622, "uuid": "1743ba8f-f47a-4dc3-b114-0041f35ba032", "comment": "Malware payload (BitRAT)", "value": "4a2c637afae46b94c57b9b53a76f68f31c3fed0babe01d75dedfb71caef5d7f118e2ece12a512c6c1abac4b4e2a4f657", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429622, "uuid": "acd5474f-870d-4f19-b253-e8d0e5353fed", "value": "T1E295231077F0C035FAB315F969BA92B8643ABCB15B3492CF62D05AEA4764AD0DC31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429622, "uuid": "f08be7ee-a246-4797-93b1-5dfb8f6ad07f", "value": "f74a0f3da1e112835a6ac32552c0a4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429622, "uuid": "9d6c3e26-6f2d-4df2-995e-92db60136c5b", "value": "49152:f1u8kdhQrsovCSc1I0A6dF+7VWICS4CGHnN3I2W3RfG:f1lkdumSceX4I7gw2NyfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633429622, "uuid": "e07061aa-3c34-4b86-9d27-3a70ec30088d", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633429622, "uuid": "bbe2559d-ccba-4e5e-b50d-ab0ad3e89aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429622, "uuid": "83d441b7-cdf7-4dbe-bce7-faff6252f037", "value": "20ed11e944ee0625399cb7762aa60255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143edbc4-25fd-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633452943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452943, "uuid": "f987af6c-d534-4f0d-ae36-a4d8cae31fe9", "comment": "Malware payload (AgentTesla)", "value": "f11c1ffa48aefa8ac955c60a6803f8fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452943, "uuid": "03c16347-5039-46fe-ae04-42b823b839e1", "comment": "Malware payload (AgentTesla)", "value": "93a82b7810eabe49c667f08aed2575bde3d3d536538031622aa9e2566b81ffe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452943, "uuid": "0a2b8273-beeb-4fcf-8b3d-43abce18b3d9", "comment": "Malware payload (AgentTesla)", "value": "8ab2a196b446c447f352093e0fecf74644865bcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452943, "uuid": "fbc3ec6f-a851-43c3-b256-440fcf83a284", "comment": "Malware payload (AgentTesla)", "value": "d743502ca9da1f5e3b5a53f184391d38b09c2f6d343d8a7ecb314e2f30045c8e88ea0a68c5d190f38b4be81980924b24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452943, "uuid": "d8cd04e3-e251-490d-9299-c7fe2af712d0", "value": "T132B4DFA922AF6F45ED399FF4142C619193F67C372179D3290ED1B0EE6D22BB00A50B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452943, "uuid": "dc61c864-d956-4f1f-88e2-5e46b451c462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452943, "uuid": "f901b3f3-1dcc-4b89-9fd4-2bc18c8b51f6", "value": "6144:qnSe5HKznhfQ+3HwOcc0WzD13MrkgMOq4VTBtFkJkyLHU+oM1dyofOZF+I102QpM:v4occ0Wzkq0BPTyjFFoofK5aHf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452943, "uuid": "5f9a3a6c-c3d5-4dac-a173-f629c96f2e61", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452943, "uuid": "fa2f74d2-eb87-4326-88de-0d2216cf8f28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452943, "uuid": "7d68e21b-6679-438a-ac57-669d2b2f54c0", "value": "f11c1ffa48aefa8ac955c60a6803f8fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b036113-25b5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633422031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422031, "uuid": "f386deab-14a2-4094-847c-69071b3c1ac7", "comment": "Malware payload (Gozi)", "value": "9e2be92580cec672e36faf332a0f4444", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422031, "uuid": "f4854597-f14b-45bf-a0c0-646f3d9fa6fc", "comment": "Malware payload (Gozi)", "value": "93b16773b3d5519eb7a85aba5b3393e22229f15c0b56a011e9d94bdfc3fd0606", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422031, "uuid": "1bff90cf-1ab7-40e3-84bb-7241e9a89a25", "comment": "Malware payload (Gozi)", "value": "9d083640d20266096480b6ba19a4aa5d5c6b50e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422031, "uuid": "e31d0365-3840-49c5-86f6-e9db53a18286", "comment": "Malware payload (Gozi)", "value": "2c460f7c63ea73cd2e90bacf33c8f1ed2807c47c42f54fdd63eb6dfcc7c642f13b0110e5f111088770a6d9e5ad36d576", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422031, "uuid": "8c3b2d8b-8c50-4356-b21b-29e190ec177c", "value": "T1FC13F17788A39453CA8774371E30457A644AC682053EA5C6D58F9A8F2CED089E43B33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422031, "uuid": "4a1b6d0e-bc2f-4ef7-bc4c-9c3df9b84358", "value": "6e9163c62b29a1ccabed40ce8621a95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422031, "uuid": "571c6e81-df8c-43b4-9518-e9cfa298004e", "value": "768:4KA/NIU2MQveFElgl9Jjeo1L0BM93+MTj5H2oATDBinjAqwODpOPCz0qyy:i/OJG1eo1woLPAJUjAa0Pmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422031, "uuid": "da8d8c3c-758f-414d-bc0f-a38391cce01b", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422031, "uuid": "c2667af5-0e65-4117-adcc-7102ff7eaa3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422031, "uuid": "49c4ae54-af48-4bec-907b-13461787d550", "value": "6d490000.da.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c079a7e-25f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1633448661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448661, "uuid": "236b0763-cb64-46c0-b11a-9759047a50f2", "comment": "Malware payload (Hancitor)", "value": "e29e36e214a7304a0fb7d653783bb0ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448661, "uuid": "45235cae-36af-41a7-aa13-a4cdb15641f8", "comment": "Malware payload (Hancitor)", "value": "9481c36bd2cc5592f5dfde1eb8da1c55d618c42df22b1db8ec28f8b26dbd6a3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448661, "uuid": "d5b1bf71-cd96-4513-a956-1894507da818", "comment": "Malware payload (Hancitor)", "value": "116151e72daaa8bbbad5edfcec520c626c948f01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448661, "uuid": "511c3ce5-02ea-47ea-8c6e-abb59ea936bc", "comment": "Malware payload (Hancitor)", "value": "1ca026b388966d7636d254d31afbdf33c258654d1db27d0f9d1a0a838a73fceb8ba6fc6b8344beba2bcbeeb38b12c3e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448661, "uuid": "601332d1-fd6b-40b4-b4f9-bb7101124798", "value": "T13974A5003A51F911EAAD2972CF29C5F907157D09EFB1B49F79E03E1F2AAD9A3C915302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448661, "uuid": "d26149fa-5a7f-44ca-930c-46432d407e98", "value": "2843031ace0f9aaf0e996a95ec288c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448661, "uuid": "367831d2-ce12-4da5-bf16-4ead65fbc98c", "value": "6144:zhcG/zP0c6uPZz2YNtuKvLNAOjLr17Xv/VwKrIjEsFtLD4fTpCVs6euwW1bzH7pi:zyG7MuPZactHvLNJrpXFA3LsfsPeuwWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633448661, "uuid": "39412fc0-8136-4dab-8d63-713e9ffdef8f", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633448661, "uuid": "6851eb25-5a64-431f-bcb5-7cbea3ffe877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448661, "uuid": "8d1f3001-2fa8-4887-a780-a6652b72b4cc", "value": "gelfor.dap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a977ce-25ae-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633419088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419088, "uuid": "941d223e-9edf-4841-aeb8-fb100bf1e31f", "comment": "Malware payload (RaccoonStealer)", "value": "0df3c0aac31d4082cfe07b69d7e000f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419088, "uuid": "d9978c40-7059-46e2-b4e7-2e5149e41663", "comment": "Malware payload (RaccoonStealer)", "value": "94fa63932fd9e139fc7fea086cbb677c2b29529e882d2b9c21979b7c075b00b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419088, "uuid": "15564f06-f656-4aa5-a0e0-71931df419a1", "comment": "Malware payload (RaccoonStealer)", "value": "f61525b5f03ed8b5c4d72207e0767d9e980654a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419088, "uuid": "9a73fc49-5b2d-47dc-8e06-33722be97cd7", "comment": "Malware payload (RaccoonStealer)", "value": "6457513b41eac06a169a7bf9b55085e5997e779fb4e6664a56500145b494d1cac7be44705ae23fd1ef90d167f2cc7052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419088, "uuid": "31e072c6-d7b1-4770-add3-743ceac887c5", "value": "T174B4E030A7E0C035F4B702F9497693B9A92D7E71AB3890CB52D41AEA57346E8DD30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419088, "uuid": "ec5ee343-ec7a-4b5b-9163-4437d974e605", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419088, "uuid": "d42e95e7-9eeb-455d-b075-533008aefa66", "value": "12288:RvB45eKltcoLtEkQN4eTLN6rSAE5pezycmuI8xTEziD:r4coy2vrS3SvHozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633419088, "uuid": "c2c6d127-41a3-4048-9837-524c3d2881e2", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633419088, "uuid": "fb85c375-c3eb-4155-a545-d999dde5bb06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419088, "uuid": "bbc33b63-adca-4a84-8bc0-2fa40b14b53c", "value": "0df3c0aac31d4082cfe07b69d7e000f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cf0b6b-25e5-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633443010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443010, "uuid": "527740e5-b904-4022-8767-3b9d7fbb70f7", "comment": "Malware payload (Quakbot)", "value": "4607f36948970336c376e27350832138", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443010, "uuid": "33d9a87f-c287-4463-a408-5c44ba7f7fcf", "comment": "Malware payload (Quakbot)", "value": "966a07b1051044e7c89beaffe7d4f4efe5fdd837c544cc59f3d72cb4be323480", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443010, "uuid": "6ef6cbe4-2d8b-4fe3-8c49-d5642130cbbd", "comment": "Malware payload (Quakbot)", "value": "6dad579bd09b062b448013dfe831ffe47b787a82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443010, "uuid": "e5f350af-8168-4962-98fa-50267658354b", "comment": "Malware payload (Quakbot)", "value": "4a1dd97c684225b1c6df7a6904a280a2322c13e984131af1a8c1bbd8fe33d6314af187b0a023262f671dbe56a9d05a11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443010, "uuid": "3ce5cdde-d100-4771-b33c-64f0e38c37cc", "value": "T124350D543A54F510EAA86972CF2AC5F907157D49EFF1B48B78E13E0F2ABE8A3D512301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443010, "uuid": "bbe216b6-7da2-4623-bf71-f08d162a2697", "value": "b23fd6f0978c278dafa7cc4b47a8b77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443010, "uuid": "fe30ecb2-559c-495e-b006-b81b889c0ee0", "value": "24576:r+N4Rsx8ZIlcUFagUOqtQ1e78l1T9N36OfMMElHNGlpJMFymEYe/uAg9JXkQKLKr:rTIOUFa41l1T9N36OUMzlpJMFymEYe/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443010, "uuid": "9a5e05bc-cf24-4cdb-a5ff-7ba38af86a1f", "value": 1094250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443010, "uuid": "a34a5b4e-6088-4c3a-84f1-75947f90df33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443010, "uuid": "2ace3753-9e7d-4059-ad1e-89ae0896548f", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cf115f-25aa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633417437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417437, "uuid": "b88822a5-3a55-427e-9aaa-52469b9a5dcf", "comment": "Malware payload (AgentTesla)", "value": "056200319751e3b276a22f27bd1149f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417437, "uuid": "0c9b7a31-55b1-4ca2-b59a-03480887669a", "comment": "Malware payload (AgentTesla)", "value": "968ff9474f24dc8e077288dd060e8fadc8590046892179b431d765c67a117c11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417437, "uuid": "efa18799-6797-47d0-bf23-926b6d611d94", "comment": "Malware payload (AgentTesla)", "value": "872805e1f8918d322193de70a8f4400b7d774015", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417437, "uuid": "797dc869-fec3-4f71-9136-b7125e52f2d8", "comment": "Malware payload (AgentTesla)", "value": "45d62f374d334c0f14ce4f5c69316297097b503f0899f3180c50b95996f85d1a453db9224e14054473ad58cc4589d44a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417437, "uuid": "0857f135-b7bb-4cfe-88ef-2007a06fde67", "value": "T1306423E6D391876AD442273A8239B726FB36CB20440594479BF81D6F7D0358F4E4F29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417437, "uuid": "3a59431a-5e73-48d7-affe-4b67d63d48dc", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417437, "uuid": "b1b11ad3-5389-4be5-8169-e7ea9e080d07", "value": "6144:F8LxBsFPQk/RLrhnIrfGPfYkH7hzjYCt11jmGhHYGGcU9S4BMAiiR1dM:/FQkpLr8VkGcRBHPU9S4Su1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417437, "uuid": "03ded6b9-546f-4366-a079-8b9f88129eed", "value": 314764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417437, "uuid": "13c99ddd-9182-4b78-a1fa-d2008f929b12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417437, "uuid": "5030da25-f2bd-447a-98df-9d1a6120620d", "value": "056200319751e3b276a22f27bd1149f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c082f245-2635-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633477284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477284, "uuid": "b8e7e904-4ae2-4763-bdbe-95eaad6ab2bc", "comment": "Malware payload", "value": "e8cccc1e5be40fdce85ed75f7a12ae7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477284, "uuid": "a275c438-8224-4446-af71-5b4c6ab736b5", "comment": "Malware payload", "value": "977435f97d34304e812ea3da5ae1fd0586d87a4b159bbcf89b2343611a4b5c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477284, "uuid": "cdb90780-911d-47af-a0b6-c5376b6da388", "comment": "Malware payload", "value": "fbbcd90c0c2f6b2c3b4f701d588634d4b59bb6d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633477284, "uuid": "d11f5276-3128-44e2-9644-d98ae08f1ca2", "comment": "Malware payload", "value": "6b213dbd1d57dc63e7770ae70a86211f553cc846e8f5f41d60d786e6737f6c7e1858e3c8244cd41d82356ef7ae458257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477284, "uuid": "ccb8a51c-f435-4284-93ca-5337aa08bfab", "value": "T17BF29092E660CA51C5E73AFA489B86B407E4BD1BBA13CB5B54CC3F8E3DF23044712616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477284, "uuid": "d3851301-8ad2-4a93-8b74-56a50ca71613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477284, "uuid": "98e02b43-72c2-4dc8-9401-c62e6465def8", "value": "384:7DBIoNipp/uQQTLNrGMn3b/Zwt7Dv4WhXP5JRzbM06fjLE+5QnuS:7YpsLNK43bKpv4WFFzb4E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633477284, "uuid": "325e64d4-710c-4599-bd14-a1b4242a5f71", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633477284, "uuid": "24c09dc8-2f57-4893-810a-205118d42f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633477284, "uuid": "5ada5303-1b03-411d-a5ba-d04218196047", "value": "977435f97d34304e812ea3da5ae1fd0586d87a4b159bbcf89b2343611a4b5c6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7adf25-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1633437492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437492, "uuid": "826c8adb-a410-4203-94d7-39ea3bc27d43", "comment": "Malware payload (LimeRAT)", "value": "53a65a893f9598daeb2d8e6875facf11", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437492, "uuid": "8b3f05d2-29cb-46e3-b65b-1e2364963098", "comment": "Malware payload (LimeRAT)", "value": "97b032f29e2966bd64a69ce27be337756c42041994c30f553f92a80e03eadbca", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437492, "uuid": "2c7e246b-887b-4d85-94bb-fb019f9dda1e", "comment": "Malware payload (LimeRAT)", "value": "e8225960f8cb51c477e888dd4e30910b13871651", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437492, "uuid": "cb8549e5-cfbd-4292-b492-623a07a675e0", "comment": "Malware payload (LimeRAT)", "value": "31ed86a000a3beca77bde6556b8fb5ed95646efc05ef3bc5bc817e601484eee93b7f95ba9adacb3ba4b19af54d24701a", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437492, "uuid": "cd2c5d92-a348-401f-9cc0-98d64f3b7c48", "value": "T14BE2B492F65493B0D3E607F7B8EFF04CE3AA982D02079999F4503E8C16726915EF661C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437492, "uuid": "2976b036-c1d8-435a-bf46-4693d87c31af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437492, "uuid": "fcc4b4ac-19c5-468e-89b7-58a21f342a8c", "value": "384:wMWdArglNPITMADbGbzZNygLMyKziVE2HWaB3g6sI5vNesl:wMOJNQMAbGbvy4MyKziVE4H4yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437492, "uuid": "11338f9b-b7df-4f63-b3e2-61b17405f9f2", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437492, "uuid": "dd1d6d79-676f-48ec-89b9-5f9c533ec946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437492, "uuid": "bca79305-d6d2-4c15-ac24-cbd28db354c5", "value": "Copia de Pago_Banco Santander_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86f16df-25c7-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633430106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430106, "uuid": "4d4f0d02-de3c-4ebd-b1db-70bea4a48451", "comment": "Malware payload (Loki)", "value": "3eb855cf3d2aad29074cca7aabc54180", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430106, "uuid": "9c997f5d-a8b3-4da9-975d-c168405fe16e", "comment": "Malware payload (Loki)", "value": "97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430106, "uuid": "f8a8993c-0a85-47df-864a-aabee9dd0779", "comment": "Malware payload (Loki)", "value": "0e9e7b3bdb690d391b941520b9acb3fe20008368", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430106, "uuid": "f1851b76-0bb4-4567-b182-ad8d9be63030", "comment": "Malware payload (Loki)", "value": "15ec202867a4865f0e4ce49af6f3ddf1fe7e39930b88f6e4efe2569e674d35ea5286f7081e551c3b2bca4baff21c6c43", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430106, "uuid": "7da1936d-18b4-4228-9539-14c96863d7bb", "value": "T18D94AE9533AF6F45ED348FF4181CA0C157BA6C376169D3690ED1B0FE6922BB00A91E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430106, "uuid": "b14c3c9b-aa6a-49a5-8e7d-cabea13a799d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430106, "uuid": "12d7dbb5-b12e-4bf1-975b-b5610c4d59d4", "value": "6144:7P40bCry6Tnh3Q+3HwOcc0WM2Y7zXNcOUqdWL7CDgrClaG9PYVoPWiN:Tugocc0WMp7rNcNqdWL7CD+ClaG9Pwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633430106, "uuid": "8c4b3dd2-c32e-43ab-92e4-61633e4bb819", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633430106, "uuid": "bc6d17a7-7648-4f71-bcc2-7d403b165377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430106, "uuid": "d197cbea-f4f6-422a-a811-7fc9226da887", "value": "Angebotsanfrage 05\u00b710\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3935e5e7-25e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633443127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443127, "uuid": "a7a714c0-ad78-46a7-a01a-3cf9dfe90c99", "comment": "Malware payload (Formbook)", "value": "8f48ae7e6330a607031c4d7ac6ebef2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443127, "uuid": "3269a792-9b5c-4d69-92e8-0eb1c0d3fd29", "comment": "Malware payload (Formbook)", "value": "98257df783e840e80743c3482da475c0a8b0505b1eef573c4f7c968a9e53cdfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443127, "uuid": "b0f7f3bb-6e6d-4f01-a828-2635c84c3ae1", "comment": "Malware payload (Formbook)", "value": "d06a09bfcdb7b64b56224378bedc95f248365a2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443127, "uuid": "12eff1d9-6adc-4c71-b22a-587c27bbd9e3", "comment": "Malware payload (Formbook)", "value": "2d34f6059962ef32376e55dad8447a006a6c5ce600677eedb73696e39db909c0de94a9b601c9eb9c718f28840988b8d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443127, "uuid": "7b989e96-dab0-4810-8c7e-3fc6fb059afa", "value": "T18074E0923BA487D4FAED9B780479500053F6E7599736CB0F7D89C09E183BE86835C6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443127, "uuid": "50277c5e-7fa9-418c-8355-0dd46243fb40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443127, "uuid": "379a4bd4-f141-4929-b90a-514298e0986d", "value": "6144:HnyMQ9bXFZfl8StCt3ekRcNnFnHBNXlTEGtxh:HyMCft23ekyzhNNVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443127, "uuid": "8ce1829d-c9b8-4a04-bc2b-eb7c699ff642", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443127, "uuid": "3167dd7a-76b1-46d6-8f91-8cfcb07baba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443127, "uuid": "22c53846-8eaf-402b-84a2-159038581f1d", "value": "8f48ae7e6330a607031c4d7ac6ebef2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b173ee-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633441965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441965, "uuid": "37c99a92-fd9c-4d88-9f04-08f772697e4f", "comment": "Malware payload (RedLineStealer)", "value": "345b77d202576e76971bc8939cfb23d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441965, "uuid": "ad7f7dfa-6510-4afe-aef7-55fd6aa61e58", "comment": "Malware payload (RedLineStealer)", "value": "99730ee9c81379d2c0d0036a8e5b3d2f4752117de1041b4716304f18f37def97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441965, "uuid": "1c823a00-4889-43ec-a5c3-cc26b3ed8b5d", "comment": "Malware payload (RedLineStealer)", "value": "07faa6e9d56a9fb754d0e52326bc5f1675593561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441965, "uuid": "e36373d8-104b-459b-ba5f-29d9953af839", "comment": "Malware payload (RedLineStealer)", "value": "013a180fa0d219ea5896a75bff1ab98fa5b6cac8ab3dd2902b0b0a5a9c4f6f4fedea8ee9db6f2e976146ab2cb8eb7ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441965, "uuid": "b33942a7-8daf-412b-8160-53c52f4f4e64", "value": "T129B48E823147D889DC135AF21CAFD57011787C9E8129C61D3B87FE2AA5E735234ABB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441965, "uuid": "40368902-3759-4eb9-b38a-cc561ac44cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441965, "uuid": "2aaf42d3-722c-4891-94dd-61b263779fee", "value": "6144:VothvERQ+3HwOPK6yw0iM2Rk4dzfnKfr2Txd8hMokTestvLGyELbMUTKZp0:gESokw0i/dbKfSd2kCSiyyjKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441965, "uuid": "c67903b6-d602-43d9-bef2-258acc9c7435", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441965, "uuid": "55bb9492-a8b9-48ab-b2a2-f1dba173c4c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441965, "uuid": "7d562ad5-2056-4e07-ab24-f4aa4823efa4", "value": "DOCUSIGN_00988765334122PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e4f08f-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1633441262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441262, "uuid": "631c7860-de55-4440-8ef7-44451abe51bd", "comment": "Malware payload (Hydra)", "value": "c820b0067bb90bebed17a402715d06eb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441262, "uuid": "43a9cfe2-df30-46ab-bb9a-aa0386406824", "comment": "Malware payload (Hydra)", "value": "9a0339b27486cc1ab1bd76949e813a9a76df0226f8fdc5742e05f5008a597d10", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441262, "uuid": "5fd5292b-158d-4f4a-9c05-d85089d79b2c", "comment": "Malware payload (Hydra)", "value": "1838e61f495471f6aa23c293bccd4e715d788b0b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441262, "uuid": "d41f4ad7-18ce-47f2-9714-cd184477d02f", "comment": "Malware payload (Hydra)", "value": "06d5afedf279e8b1a397de5e43d9d1bc0c8429d3ce8854ea29c235a9bd7a37d74c20ada35f1222de5fe49040bbf44686", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441262, "uuid": "8eae71a3-2a6d-4830-8d65-23e46a3177f1", "value": "T1309633C555807241FA16FFBA0AE73BD17B11456725C1C87EC2080EAA86F4ECF6B92C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441262, "uuid": "bf19748a-40a9-44c7-a1b5-c51371e782be", "value": "196608:+J86ipqWOerFF1MZHeyNiiw82pA5FQ2oHkDWx0RiQdyjynFAL9f:+J8Rweh3D2iiw82A5FQ2Wabyj40f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441262, "uuid": "8e114aec-b793-40ef-8e11-51dc8cd178f0", "value": 9239608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441262, "uuid": "714ce484-3715-4b6a-ab11-7c0626caed9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441262, "uuid": "f7a11a25-7e64-4317-9edc-c36354a74f37", "value": "commerzbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad5c358-25b2-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633420903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420903, "uuid": "e82d3bc4-8124-4680-a093-0950ab354868", "comment": "Malware payload (STRRAT)", "value": "eb2474a77e24c36fc5559c55d9b676a7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420903, "uuid": "009193d1-c912-4fb3-88d3-3a1c6d5c0581", "comment": "Malware payload (STRRAT)", "value": "9a6ac4ac55d5533939e70ad6a9084350e0a6b454bc4edba935aafe997dfb6221", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420903, "uuid": "515ab390-a132-4d81-ace0-3bdfdd72f3a9", "comment": "Malware payload (STRRAT)", "value": "b66bdda7cbc1e98fa9bd9e99adcd88630303c057", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420903, "uuid": "4a54ff1f-8dd2-4788-a142-01650682041f", "comment": "Malware payload (STRRAT)", "value": "6327b7c568af1fc1f32f60994e090800a1f18bb50730793747019dcd97c4bdddcd63eaa4d29f4e020a14aed262be91bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420903, "uuid": "0a0fbc95-1295-46e2-9c6a-abaf19c3a035", "value": "T1B704025FB9EEC4F5E2275033E0589232CA0D919DE40190AF76FD09859CB5C7D4B92A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420903, "uuid": "22a3d8b1-b00c-4627-a20a-0a80921fedfe", "value": "3072:LJ40/PU6BAUecAq9dvvtCVTitIc3gYVOoPSYHd2Vg6GZDeO8kxdY5ouuVy:LT/jBgNk10kIcQYVOozHmvQvuluo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633420903, "uuid": "78e9be01-a3ad-465a-8a74-e94938edaf64", "value": 188582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633420903, "uuid": "4651fa7b-ad65-4b84-9ca8-42b6d222262a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420903, "uuid": "def846fc-33e5-4f9b-a3a0-1c729b26ba4b", "value": "RQF 100028153.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e768ef94-2599-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633410348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410348, "uuid": "d55137f0-2966-4a4d-8088-fb954ec2c5a3", "comment": "Malware payload (NetWire)", "value": "4a1ad23035b5f645a8fec94a9d650a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410348, "uuid": "b3ef5947-f9ad-4227-8446-d6f54e1c29a3", "comment": "Malware payload (NetWire)", "value": "9a6c78c463ea3f40ea7ae0532453f2a1c895f848b7b6dd0f3d40c723c67615e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410348, "uuid": "524e39e6-935e-40f2-8cc9-6c002e0cac26", "comment": "Malware payload (NetWire)", "value": "207b75dfcdc5200fe7ef20d4472ba2e2400ec5cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410348, "uuid": "ebb0133f-9e3e-49b0-aa8e-2de02f1787b9", "comment": "Malware payload (NetWire)", "value": "1b7b7722ad29ce6daf28beff3a33b0a746e5eff353d16d6599b81b0e30e6dc4c4996b45c84da87a70aafb9236c6e8a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410348, "uuid": "bd085aff-21ba-43bd-9c35-d920b6a09b23", "value": "T1C0342A48F64771FEED4B8831999AFE2F5B707912C236CF03DE170989DE1E8568E046A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410348, "uuid": "7b6dcba6-827f-4038-9a0f-d092ce1aa59d", "value": "6144:IOTcK+NrRioGHlz8rz0i/MhzQqqDvFfcfQEnrthsIIC324:IK+Nr8MrYi/MDqRLEnrthsIIC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410348, "uuid": "4dcceca7-d2a5-4c7d-ba7d-91fa0f5dc915", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410348, "uuid": "513ef9c5-93fd-417b-9ede-e9c85dae3aef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410348, "uuid": "4c1861ac-a135-41a6-af72-4c918b694c75", "value": "Entity ID.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b00add-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633413050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413050, "uuid": "b92bf5b0-d023-4dbd-a92d-ca140a373f22", "comment": "Malware payload", "value": "bde74c878ef5030e6bc990d7353c8188", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413050, "uuid": "53200c69-a966-4e41-b1a8-6a153d4b5aa6", "comment": "Malware payload", "value": "9ab9dc224fe2046c90284b751988cc25a7a5cf0b95fee571bc9073de55f4ba22", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413050, "uuid": "37dcc893-49a1-4c2c-bef5-79b5dd5abf31", "comment": "Malware payload", "value": "477a6ef36bfb2d1319660faf42d96876ecf7256a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413050, "uuid": "14b4fb5e-60a1-4f84-ab7a-70bcf72aea8a", "comment": "Malware payload", "value": "f489278cda41066d51dc49b638de15d400bbbaec015cfbbe49da23cfef668e4899ce511784f50d1b243edfc8514499f9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413050, "uuid": "a42ee93e-3861-44a9-8eb4-f98159b95823", "value": "T18E228E2CC502F81BC11145BDD15683F1FBAE50D3E612BE2D2194729E07A02C757DEAEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413050, "uuid": "cbdb4c33-5f49-4cfd-b3e6-e33f26f9b745", "value": "192:ScIMmtPp8G/btCX0iSOB8eamWBXfc3zpUN:SPXxrtCEiSOBTo02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413050, "uuid": "5df95b1d-7cf1-4e17-ab7a-3ff5551f3643", "value": 10336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413050, "uuid": "c9df123c-c346-46ac-ae06-91faa9484533", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413050, "uuid": "afc242bc-b899-4efe-8471-7cf188775a92", "value": "DHL AWB.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f24ddc-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633440947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440947, "uuid": "cf8f9150-893f-4330-88b7-a2da02cb462c", "comment": "Malware payload (AsyncRAT)", "value": "a638fe99e0a2474ab1a7dfa578385358", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440947, "uuid": "ce46d683-2c5d-45b6-86b2-c41f4132b81b", "comment": "Malware payload (AsyncRAT)", "value": "9bba8da97126bd234b2786bfa91d1883fe18fb3b7b0562d0853961eabec986d3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440947, "uuid": "72a8881f-81e6-4378-b4db-b4a220dcef89", "comment": "Malware payload (AsyncRAT)", "value": "292495325197928bee307b8bd04c875f29b8cccb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440947, "uuid": "4c7ec573-b789-450c-8bea-5e4a9c4a2edb", "comment": "Malware payload (AsyncRAT)", "value": "2894037727a8da11db6b5881e9b314a50e73248df0f5ddcd6c182d54f3df688fe1b8ba32dcf1a51abb0be1cfc978a79a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440947, "uuid": "eaf5d86d-6973-416d-807e-2fd12462af2b", "value": "T10A159E65B7ADBBA6E81F0F3AC813214083E1C9275736F66B64D13AF60D296C79B0F111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440947, "uuid": "5a61cb19-4bb6-40b6-8f44-4878c81b3b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440947, "uuid": "75fadd09-44f2-474f-80e1-0e927225007f", "value": "12288:DNbXvHVtKgYDX/T3bta2iNHc1MwJ7D7OYyZUVwaCagYiK:DB1tKJDPPta1Vcn5OY7s65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440947, "uuid": "4b53c7fa-f637-4dac-a4f4-b0ff4346c2af", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440947, "uuid": "55a80df0-0904-45f2-8b46-8f33dfdf66bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440947, "uuid": "6c91792c-52a0-4290-9803-5b8fff1aa469", "value": "LOI-2021051076638925624\u202eslx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d53b293-25cb-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1633431698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431698, "uuid": "998dc79e-1f37-4bd0-b7a0-12f7ee1c45f7", "comment": "Malware payload (DarkComet)", "value": "13d4e72a61618efcff3e6cb35cadd71a", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431698, "uuid": "d2d45f57-789b-4aa4-bf88-e6fe482e9229", "comment": "Malware payload (DarkComet)", "value": "9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431698, "uuid": "40d0975d-0708-40c6-ad46-68f6035fb12f", "comment": "Malware payload (DarkComet)", "value": "b7dc8f7d695418dcfdd28cc832af4c84e2b3bc00", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431698, "uuid": "961ec36c-4bec-4bfc-b934-5cc38407aef7", "comment": "Malware payload (DarkComet)", "value": "8c6fe5b97aafca7259007f043a801b4d5301331f9e9255ffa9ebb7215917280a3699b038a648fa037e26e59dcb962432", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431698, "uuid": "f23b92d2-797f-48a9-8f62-2035ed7674ce", "value": "T13044D05271A8F896D90A13320DEACAE52636FC508D5AD7173589BB7E2F337E285013DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431698, "uuid": "d8224863-f32f-4081-9fef-77ccdd5637ec", "value": "6144:lxEtjPOtioVjDGUU1qfDlavx+W2QnA9bYBj0MU9Gu2TyAOXqvyG1ewWkHqGCFbmu:rYV0MU9GuQOaaGww+GCFbYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633431698, "uuid": "e867c817-4f40-4b5f-84d2-6c9f8d6273b7", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633431698, "uuid": "3c573471-80e1-466d-a5b2-7df5c1a11401", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431698, "uuid": "a8e211f2-c919-409c-971c-e9e54174d6fb", "value": "Zahlung.swift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc09adcb-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633437817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437817, "uuid": "ba851c96-331e-423c-a8ad-787ca7743661", "comment": "Malware payload (GuLoader)", "value": "88bad78f3e083b19efd896cc5291cb53", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437817, "uuid": "3ff1804b-0b18-4c00-b7ea-39c3484bd55a", "comment": "Malware payload (GuLoader)", "value": "9c81bbf1bc2ab2eaac0c64e9b2477fc275fcbcec4f9e93664f7f754a6a73f11b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437817, "uuid": "43995055-cbdd-499e-94ab-f22ed0785277", "comment": "Malware payload (GuLoader)", "value": "0bb8c8a52dbc6b2e9b57e95a3dd3a17b889a944d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437817, "uuid": "5e022d4e-efe5-4436-a8e3-ac7b8228b208", "comment": "Malware payload (GuLoader)", "value": "b0fd7d5740b783c89537fa3dad31f936fae7c2b9a1b06f511da494583c737baae1b4271c532407d4dbc7bfcd0b2936df", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437817, "uuid": "60c5b790-51a8-4c79-90fc-31833c8ab82c", "value": "T14BA3C431E890DFE9E819D6FEF734F0BA15F1AE22C895490731483F1964F22C669F4A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437817, "uuid": "4f387ddb-d8cc-4fec-867b-a8af7cab9fff", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437817, "uuid": "91d182ed-6698-49b3-8f95-848ce1cc7fe2", "value": "1536:tqgeD5O7Ue+MGzfyW48Rk46AFWIs7ybBT8+tIlIG:toDWsqfhxSNs7yg+t6IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437817, "uuid": "62f9298a-0285-45d4-af72-e1de86685f97", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437817, "uuid": "464451a8-7798-4c2f-bf23-8bce8f92d801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437817, "uuid": "eff24e01-c7b1-40b8-9297-5075e356f0dd", "value": "DHL00051021_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf837e2-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633416476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416476, "uuid": "f5003665-9251-49a9-8de6-3cd20a71f674", "comment": "Malware payload (Metamorfo)", "value": "b30cdb10b1bbb02f07e5933be30b21f9", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416476, "uuid": "54b5108f-8371-4a56-a158-de626d04d14e", "comment": "Malware payload (Metamorfo)", "value": "9ca18c877fe3d8588bc93f7265307291d0fa47b1b9e9ca077b7b40f6972fee61", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416476, "uuid": "1672b7f1-7417-423f-bfeb-6c8d961a7bd1", "comment": "Malware payload (Metamorfo)", "value": "d816b6fb34a32da4b936993ff9c59fd770dd1ad8", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416476, "uuid": "79c44d67-dae3-4577-b39e-55304b02c3a9", "comment": "Malware payload (Metamorfo)", "value": "4e8d82025fdf315c0f72ac4036617a203464557f5b1ac517c08031ec3ce35eb0c4e5e0b2159f6c37a6d1d194545d9fc0", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416476, "uuid": "565e0ac3-a183-4989-9e0f-2ac9e65499c6", "value": "T1C931B1051ED6132AC3B3CF7A5077A2474A76FC519D934F9D808497DA28A1054FC34E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416476, "uuid": "1af83c83-b031-4eb1-b841-db83744a7bd1", "value": "24:8+JUHRlVo5kcbA+PplYc+/P+POz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+hlYTy1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416476, "uuid": "cfc7cc21-1ebd-45d5-9047-dfb8ecf28093", "value": 1546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416476, "uuid": "9f8aa06b-5b82-493d-9c53-502dd75b895f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416476, "uuid": "812c39f8-9e20-46d6-8b5a-a19e3768b286", "value": "Curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307634c8-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633454279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454279, "uuid": "a5609ffb-5067-4f7b-be48-f4a0aa77d9dc", "comment": "Malware payload (TrickBot)", "value": "831f220740cae12d30eba7b409983f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454279, "uuid": "43f2745e-ab04-422f-bddc-478ffac7e1d4", "comment": "Malware payload (TrickBot)", "value": "9ef22f6e73a5eae7a8d1f9fb682e18a413d3081f418238ad16c682d662fb12e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454279, "uuid": "e1af743f-7fa7-4b61-a3c0-7dc46054e7aa", "comment": "Malware payload (TrickBot)", "value": "3ead04576f8c8a4511cefdb9b8922f76eadc8dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454279, "uuid": "204d91ca-23f2-41a8-a153-e51231974234", "comment": "Malware payload (TrickBot)", "value": "79243398d2f6f40eb7d2b53ab29c0ad14ef8d992b657762d44249254fe34b54f5e95175d45ed52f7eff68912c26e2721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454279, "uuid": "2429c8df-500e-4d38-a13a-8f475e126467", "value": "T138F4BD0631C0D07AD5E221F1CED1EB295AF99E928B290FCB7B90F91E6E366C04437756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454279, "uuid": "3aac9246-3d83-435a-9da0-4cf3628caacb", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454279, "uuid": "026b26e4-349e-4875-9ceb-7cfc2c42de3a", "value": "12288:dBx+M4F6CM2pEbihXZGrVHrtz0rAK97lF/ACLy/Yw:dn4gCM2GMXgZK97H4CLyQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454279, "uuid": "ae431af0-9342-485a-a6af-19083a4a16e9", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454279, "uuid": "74e8d3ad-7d78-4ffa-8092-5afb736efd92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454279, "uuid": "37732eb4-db69-4562-8f24-3cca0c5e4c5d", "value": "831f220740cae12d30eba7b409983f11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff93161-25e4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633442440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442440, "uuid": "d5f87013-8bb2-476d-9488-d005517686e2", "comment": "Malware payload (AgentTesla)", "value": "c0724a5c274680516eee8e6ce502bcbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442440, "uuid": "91448735-ff1f-4af5-8c06-ee618b5ea6ac", "comment": "Malware payload (AgentTesla)", "value": "a04979ab597b661bbc3b05d8182a886ef390e7127dcef4d2fb044cd720f1e781", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442440, "uuid": "022746cb-d4c6-4203-a1e6-063bacfa56d8", "comment": "Malware payload (AgentTesla)", "value": "b2f1cc7a16eb8004836686349b9697e7d0000348", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442440, "uuid": "ccf71db5-136d-4885-a3a5-1689ab5347ed", "comment": "Malware payload (AgentTesla)", "value": "48accddad1931366baa0677ca3e3f44d28416672eea2c4cdd6099dae15f4416ea314b3bc563f477b5e9dbad25661c96a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442440, "uuid": "b88b32ef-fbba-4ed6-a44e-39373ff09725", "value": "T16CE4E09C636F8510FDBA43F6787060905BB2B4262466C73DAF8024FDEC627E58E95723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442440, "uuid": "a3575dcd-bbff-4ac0-8a3b-e932c9fcc307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442440, "uuid": "b3afdd57-24d8-43e4-9030-ceb31bbf7a66", "value": "12288:r4objDh5mB0yTu8pta9jAMZUepWyxP9bMJT6YashlM0JT6YashlM:ME/hEpTnHCpWynbI9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442440, "uuid": "e0768019-f0a8-41c2-bad4-d78c58393495", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442440, "uuid": "ddee9a35-8b3a-4bd5-abce-ab05e4d3dd96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442440, "uuid": "8baea606-d6cd-4647-8344-9aecf9369135", "value": "c0724a5c274680516eee8e6ce502bcbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fff6c0e-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633411812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411812, "uuid": "e7e381d3-b0b2-43ee-a025-0e312af023f5", "comment": "Malware payload (RemcosRAT)", "value": "fddc7a8c7b9ad37e74b5e8a6f5a5c057", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411812, "uuid": "3477d507-4136-4c81-9169-3aa9114306aa", "comment": "Malware payload (RemcosRAT)", "value": "a066bc99ab0c50dcab13674a1857996d12686443c35b02ae9920eb854942ea16", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411812, "uuid": "8b926acc-8f28-48fe-8d3c-72e8f4f99557", "comment": "Malware payload (RemcosRAT)", "value": "e9d03cde6c4b47463042fb5a62f65158fcd904b6", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411812, "uuid": "a089486e-c41a-4633-b753-22946ef8668d", "comment": "Malware payload (RemcosRAT)", "value": "95a205fd5e13103ba3b036b2a3f2414cbaab1ba31edcf3c9f32d0a3a99d7200b3cb926d6c8be121c3aabb77b067ea1bb", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411812, "uuid": "3eb84129-1c63-40b3-abe1-992cf1cb892b", "value": "T1500519642250532CF1633775E81B025477D1A83C1E145BB7F2A82B4B1BAFB869EE847F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411812, "uuid": "054b87e3-b70d-4877-ab1d-11ab24149757", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411812, "uuid": "35c954f2-73fc-4b7d-ab85-dfa01ac29260", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNSYAycjL7YiEFXXXB:Naeq3gF1Sf+WIydAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411812, "uuid": "f9eab785-6d29-439a-baf9-ad5869ce1fbc", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411812, "uuid": "f8a953d0-bdd1-452f-8f2b-12b13f2355a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411812, "uuid": "e480626b-a759-4f10-b3de-81a2d457ff32", "value": "Nuevo pedido _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9634b8-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633416663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416663, "uuid": "110e9457-2c44-4efb-bd84-612f5ed4459b", "comment": "Malware payload", "value": "227aabec1949c8a4e3bb1b9a274d9feb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416663, "uuid": "50cc47df-6b5e-43c9-a00f-894f9561e153", "comment": "Malware payload", "value": "a08baba3ce230912cd21f6580e16bc632f6b2cf552853507b35ffab4f61ae6a3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416663, "uuid": "f405e5ef-9a2e-42e4-90ac-82398d391535", "comment": "Malware payload", "value": "0e1517b29082945c2b5c874be45fd635faa7bf0b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416663, "uuid": "acd8895a-cfe2-4bd2-bc66-4ed0996b3295", "comment": "Malware payload", "value": "cde8ab2245bd2b3e3899f52c75f180341a71c25e1746d548f096d1f29775830c5c60df0dcdf57b1b63a494d1d27ef085", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416663, "uuid": "035fe564-5015-4537-b38c-6d42346ab221", "value": "T1BBB57E22B2D18437D0776E3CCD6B6399942A7D602E38884F7BE41D4C5F397817A292DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416663, "uuid": "8dde261a-5f49-47a9-b289-255bd4f3aa7d", "value": "49152:tJ9OYuozSMZ4EqWPcntO8dlVpyTPTVdGA:lOYPzhKE/P46yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416663, "uuid": "bc133767-50c4-4ad2-bcd8-e14a47cd17f7", "value": 2374656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416663, "uuid": "cd27680b-752a-43f8-a115-18be7bbf2e01", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416663, "uuid": "933882fe-ad53-4e0f-8457-4f60e420920d", "value": "mp jvxzrwebqznmpykrscm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a226eef-25b1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633420285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420285, "uuid": "c259d21b-914b-4009-9ebb-7273a73bdc59", "comment": "Malware payload (RaccoonStealer)", "value": "cd707f2758973f2cc9c70dd60cc6b73a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420285, "uuid": "62b149b3-ec65-45fc-bc1d-37bc1c65e08f", "comment": "Malware payload (RaccoonStealer)", "value": "a095257e1db89c952439dd58f5b45b2446748b73096cba29014caff562ccaa29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420285, "uuid": "892eaa6c-5cd2-4224-968b-460612890cbd", "comment": "Malware payload (RaccoonStealer)", "value": "dce01debbd9a458e460c1ab03a9de53ca9e9e6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420285, "uuid": "07de1e86-0d73-4e91-9125-0b5eb900c366", "comment": "Malware payload (RaccoonStealer)", "value": "a233205d2c41005dcd0f4e8dd5b44a5e1c6e9f9d4d3b295747bee7ee5bcac6ed6990e0077df616b72fef07d429f920c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420285, "uuid": "03bf3c1f-29b7-46cc-996d-d6712107bf83", "value": "T1A5449D30A7A0C034F1B712F849B597B9A92D7EB2973490CF52E41AEA57346E8DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420285, "uuid": "7d94e35c-1901-408d-bea1-2ff313564896", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420285, "uuid": "c74a6c52-176e-4c50-8b44-02b32a1d21a3", "value": "6144:bo6fJvg1Ost9pfnOty721owATMXtuwvpdY8ZFO:bvR41Ost91Ir1owAYXMspdY82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633420285, "uuid": "efeeb4b7-6d11-4e71-b33a-2bf5a6a474b4", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633420285, "uuid": "c8fb2f11-117b-4a39-8192-00106ab1bab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420285, "uuid": "14d098c8-511d-415c-a902-46705d04f2dc", "value": "cd707f2758973f2cc9c70dd60cc6b73a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9473320d-25eb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633445427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445427, "uuid": "3cb76558-290d-4d3e-a7aa-7832dd0ce5df", "comment": "Malware payload (RedLineStealer)", "value": "85b9b72f4e6f2e30f0f7d07821d3431e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445427, "uuid": "5dc14ce1-e8a0-4238-9323-c363690b49cc", "comment": "Malware payload (RedLineStealer)", "value": "a0e565d4dabe4fca53afd035b7c4c0ec68d79e1655042ce42c38e85f18e3dbfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445427, "uuid": "b42a45b4-db87-4847-aafc-ba504e92ce8b", "comment": "Malware payload (RedLineStealer)", "value": "fcbb773175b3724ba31fab6c41b43c14e30b3eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633445427, "uuid": "782d9f32-d69b-4c40-8706-a3fb1344c24b", "comment": "Malware payload (RedLineStealer)", "value": "6c9576c3d919c38fc2c32f177673958bc6a40e035547d5ba07cb309f0b96e9c2b97411716b620ee3530df8222598d144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445427, "uuid": "78aabc3d-b2cc-4ec8-a7da-229adce815a5", "value": "T15464BE10B7E0C034F2B712F609B993B8A92DBD70AB3495CFA6D566EA56746E0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445427, "uuid": "93683c0e-a5eb-4c60-964d-c2236dc3c222", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445427, "uuid": "ec037fc7-5963-42a0-ad46-572826f3b99c", "value": "6144:R4/U1PQpWegCO6eDWpgmVIPSpnP1m5YKC19y6Hp:RiWAWegCO6tpgmp1myKUy6Hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633445427, "uuid": "1974cd07-9ca5-4b66-aaf8-b492b59e1822", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633445427, "uuid": "a87ac642-9346-43ea-adcf-6c9ba4825827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633445427, "uuid": "4862e1b8-07c0-4587-817a-30098698a07e", "value": "85b9b72f4e6f2e30f0f7d07821d3431e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46a9ad0-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633437858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437858, "uuid": "879ab54a-2cb5-4ccc-be37-62ebbd9c79bb", "comment": "Malware payload (STRRAT)", "value": "d1c3c09502870b90648e9103faf784a3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437858, "uuid": "8a9ac1db-c225-46b5-b99b-7da0a34f5865", "comment": "Malware payload (STRRAT)", "value": "a0fcc2176b7d402b66850b391518932e077d4dadc26bfa0b40dbe234899ee03e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437858, "uuid": "5205717c-b163-406b-bbd6-b4c318a62be8", "comment": "Malware payload (STRRAT)", "value": "5f95a89f013a4e33f123d374a088a09157647523", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437858, "uuid": "64f5b5de-4b4f-4060-9e2e-23a56af8f8d3", "comment": "Malware payload (STRRAT)", "value": "49d9a735654d9f9373e60b1b0921bb6a6ba6f66b2bd8f78700951d90218ade1610d902fa7a92868f7dfcedf6ed993a1d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437858, "uuid": "66dc7175-770a-4851-8dd6-e0de3814f550", "value": "T1D8A3CF0B7E69E0E1E25B5033D5128233EB4D61ACA54597BF28FC44998C30CA95EB76CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437858, "uuid": "94ba71cd-772b-453c-a5e2-619fa4506161", "value": "3072:8dJ4s45ZdMP27IwMD9sl0ltifAFzMeNFYYJ6Avc:gSZrIwv+ltmAPh6cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437858, "uuid": "e14228d4-7d87-4e4f-bcee-5ac334c3e75f", "value": 103746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437858, "uuid": "01f62374-78d9-4221-81d6-123ad3776a12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437858, "uuid": "f566e98b-6a17-45b0-a630-a10ea9a1b841", "value": "OFAC amends FAQs -PH631299960.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17b30a2-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633442013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442013, "uuid": "a85c3f9d-e6e4-493a-a495-b3e4d27dd6a7", "comment": "Malware payload (AgentTesla)", "value": "657c9166b300556d6841d41d7148b869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442013, "uuid": "c1d76f08-3449-49ef-82c9-eea060d3ea2b", "comment": "Malware payload (AgentTesla)", "value": "a1076d68048c3fdc3c09248407a6fa1e4a7e28c23a6b45d8c3ac58e537771a8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442013, "uuid": "8b4cb064-b58c-4280-80d1-97e97a768340", "comment": "Malware payload (AgentTesla)", "value": "2c16f43d5e99d77496bfd63012055a5489bb57f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442013, "uuid": "8cbbeaa7-4926-4ff7-88b7-6fc08d2d8b16", "comment": "Malware payload (AgentTesla)", "value": "a4a71d6b4463c429ba94173402bc1a2867c78d2d36b762daaf379607a147e2d8751635918552c2df7607fe770cbcfad0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442013, "uuid": "aad2c4f3-6b40-4408-b543-52208e16b107", "value": "T1879402AD23B79308CD7987F52924F2911776A516311CCB386EDDD0EE2EA3BB04AE0547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442013, "uuid": "8ef8d124-e2bd-4fa7-94c3-f58cfcb20abb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442013, "uuid": "4a7e73bd-9ddf-4c79-a531-026fb11da06e", "value": "12288:zESo39vbeccOQ7GpEuvY/KLoA1zEWAEr/TPh+mnt6Qlt:zESK9vSccOkvb/K0ApEMrAmntdlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442013, "uuid": "102c306a-5419-4cea-bdb9-d7bf6ed00b38", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442013, "uuid": "1999422a-5cff-4b0c-8290-aa7f35f09312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442013, "uuid": "9fa8ef6e-88e4-4d5f-9f26-c96d88e30ef7", "value": "justifi4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb33bf6-25a6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633415778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415778, "uuid": "29a6b620-ffa1-4925-b058-4c8c04f8f6d8", "comment": "Malware payload (RedLineStealer)", "value": "cf0c657e28a3897d9a1a87f3c0605282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415778, "uuid": "393c5bb0-ce45-448f-9a2f-79a51c2ae59c", "comment": "Malware payload (RedLineStealer)", "value": "a10d82b52187d90d7046806ce0e24997b192d9862bbe843869a4046f1c5fe926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415778, "uuid": "e9148d2d-e99d-4777-bcd4-c94641425d71", "comment": "Malware payload (RedLineStealer)", "value": "91419caa6f9b93ca3c2534139b11990d54d4ff15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415778, "uuid": "b9c9ceb4-a030-4d18-bc69-91387c310a4b", "comment": "Malware payload (RedLineStealer)", "value": "91966b31f0285892b20916a84251688f100789d5329c55f6f11c8007c111cde22f1126d400b0ad7001eaf16c0ee61782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415778, "uuid": "2cda6dd7-d0a7-4207-9a76-0c5312ae9c59", "value": "T17B05E005F7C28A42CFDD5A75C4970C600AF5EE9ABA67E3983B24F5787663331450A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415778, "uuid": "8c700b10-b514-423d-a34c-37fe61999a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415778, "uuid": "11719117-05a8-406b-a76d-faf3711950d7", "value": "12288:9mJ8VU+0YBmXJHbPJDpo0HkWSDbfjpODvvIYKVm5qxKwGa+U3+HHKKaIo:9mX+9BmXxBDpoPjmnKVYq4wE+axno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415778, "uuid": "170aa8f7-abbf-4fe1-9f63-c28c58db1f7d", "value": 860264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415778, "uuid": "3bcf852a-5761-4d3b-a53d-a441a7418582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415778, "uuid": "5014e2d5-2b42-4698-99a7-bd09235336c0", "value": "cf0c657e28a3897d9a1a87f3c0605282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594f5347-2582-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633400231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400231, "uuid": "81190275-b41c-4059-8d87-284d75e6ceaf", "comment": "Malware payload (AgentTesla)", "value": "78b96599f396cfbf686ae87d14333509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400231, "uuid": "52c73066-464d-44f5-813d-1b7dbf8b1bca", "comment": "Malware payload (AgentTesla)", "value": "a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400231, "uuid": "2bb67c7f-f90c-40ae-8d63-8f0aea75526b", "comment": "Malware payload (AgentTesla)", "value": "ddab3525488ac6b92010685d64d446b2106a80ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400231, "uuid": "c218519a-a226-4dc9-8693-7ea7431871f6", "comment": "Malware payload (AgentTesla)", "value": "24c3b9060d246f13186da28de6f261003c6f42cde6bc936561c44532bf9d56ba53a4c4f687c1b769349704efb5205cbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400231, "uuid": "cfb37f1a-4ecc-4314-b015-37fdd2674a8e", "value": "T1DFD47CAC392334DEDD67C1B68DA82C70AB613CA6130B451390E37DA8B93D996DF540F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400231, "uuid": "0b9e6207-2117-4953-8363-0bc718f9e849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400231, "uuid": "d98126e1-e5d0-4f27-99c4-2b850734e2a7", "value": "12288:2d8CVJh4PXZrjuYU1FwC7EXFSY7yR4jwGtYJkU4z26AYEPVWWzo0x2:zC3AXZrA1FDHph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633400231, "uuid": "ffe38c12-5bab-4145-b337-db5d3deb9b6e", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633400231, "uuid": "8ec0ddc7-c20c-4c88-a581-9f1b0ca05bd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400231, "uuid": "d2657861-523a-4c81-833d-11937fdbae68", "value": "Cefla_350608317BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d527d82-25f4-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633449227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449227, "uuid": "eb9ea684-85d0-4088-b556-525a5f4715d4", "comment": "Malware payload (TrickBot)", "value": "b724179ecfdd640b5b9d8cf902cbb820", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449227, "uuid": "c0c34704-e375-46b3-b56a-1487244354ff", "comment": "Malware payload (TrickBot)", "value": "a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449227, "uuid": "a8b8ff1b-be8e-4601-9010-0f0b34ec18be", "comment": "Malware payload (TrickBot)", "value": "4af1f8c5992e69eaa1a0d4ea00445c1566775bce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449227, "uuid": "33f39b17-8f2b-4974-a8e1-fdfd70ba1661", "comment": "Malware payload (TrickBot)", "value": "058f71c44f06878123abdcc1463a2c046c917fbcd572171cb4edf84dece36f375f1888b369980c4fddb80bf8e71c43c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449227, "uuid": "740d34ea-f6b7-4b5a-bdc5-9c80a955f18e", "value": "T1ADA4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449227, "uuid": "a6899e2f-bdd8-4dc7-97a9-9d290a8b34c1", "value": "f34a0f23e05f2c2a829565c932b87430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449227, "uuid": "4c459a3c-10a7-4a39-a2de-ad25c0ab75aa", "value": "12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Klld:bEKNb/aZl6KdSrs+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633449227, "uuid": "45734a6a-87be-48dd-b4d6-8e38c639d648", "value": 487551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633449227, "uuid": "f659ce00-000b-47ab-9af0-3b718c6f9c23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449227, "uuid": "c7b8b294-0316-4580-9dcf-384ca29a6d63", "value": "microsoftExcelEarth.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351736d3-2623-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633469319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469319, "uuid": "116cb9b5-c80e-4abf-b19b-5170d7f9d2cb", "comment": "Malware payload", "value": "513d95f880ef4b0522a50c4374e40f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469319, "uuid": "6cc8080f-c1ce-40db-9301-554458f69638", "comment": "Malware payload", "value": "a28d456ec326f62b15dc6257859619c1a2dc6817f332adb9c87fbb146676dc00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469319, "uuid": "33497dfe-a07e-4ab1-8c0b-9fc2137d1fcf", "comment": "Malware payload", "value": "b89d35ab5f89a5c984ea7d4a46ced8e1603a866b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469319, "uuid": "2b74efd6-89f9-4e67-905c-c2a08a46a1ea", "comment": "Malware payload", "value": "364db49f76c0e599677500b7f5d859551e0d95b8ed2afbfdcbc42cf073732464d4f96ede8e53812eb75cb84dc00e1ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469319, "uuid": "12eeb6a7-48c3-4009-9cee-bb8d6584afc9", "value": "T1CDC49DA43083CC41CFA52FB6C9CF916407A96C376066DB693AAE72ED15123F36C459CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469319, "uuid": "2147c878-e218-498c-ba30-0c8804b04371", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469319, "uuid": "9d26eb7f-1bcf-4736-a06b-a0e6b65ab51b", "value": "12288:/isfzKQHrJH9rYovc0WEIyh/0CokNGCF6YspYQg849Rx48gY:6WbYEc0WEIwOoGKnspXQRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633469319, "uuid": "d6d18b2d-24c5-4c56-9428-ac6d7b199382", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633469319, "uuid": "39a4e35d-1560-47d2-afdd-cea07053d783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469319, "uuid": "c12c0b1a-be25-4125-8edc-2f2f5013b469", "value": "SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac5fe48-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633417091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417091, "uuid": "0a209281-1745-48cb-88d9-57b41a0b9e9d", "comment": "Malware payload (AgentTesla)", "value": "021b5dec9e6a8f3e8dd45a66d799d627", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417091, "uuid": "19dd4835-a4fb-4b2b-a6a6-214c88d37b2f", "comment": "Malware payload (AgentTesla)", "value": "a359b6ba4347547bd5a1e80d5e47614f895744abd606feee6af613016b31fa62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417091, "uuid": "69afc796-d142-434f-bc5e-9f425ffe27ff", "comment": "Malware payload (AgentTesla)", "value": "0756c29dc299476b94e0f87a24a8e4c5366f8b6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417091, "uuid": "b441952e-2696-4a89-af34-be5948ce44b5", "comment": "Malware payload (AgentTesla)", "value": "fdbcf53f3cbbd8866dab4b125706382e9b65d3ef4958736bbfb63acd07b87a7566b11d48be4d4c50643be81c19acaedf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417091, "uuid": "09630524-3ae2-44f6-a269-4a647855d90b", "value": "T13C94F1A863775605ED3CC7F52C28E38117BA542E605CC33C5E99E0FD3A23BB85AE0956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417091, "uuid": "49cd8819-7466-4daf-a847-2ca80dcbd1b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417091, "uuid": "9e331d2f-4286-4b28-8cd8-bdcc666a712a", "value": "6144:XtDDERQ+3HwO/lQDbpmVWpV0Qmm/niT05C2qvg9ar+abHY1+YvhYy/toMk0:BESo/l2AaVha00V2ar+abEzvf/KMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417091, "uuid": "8b28be08-3a97-46c8-b126-effa39afbad5", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417091, "uuid": "38bdc7b6-1924-48d6-a10f-f2b8f062b99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417091, "uuid": "518f04ce-79e2-4d4b-abc1-b62d21ec7047", "value": "DHL NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055a9cc5-25bd-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633425431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425431, "uuid": "2a1c4271-2275-4b79-8ec2-e9e555d307b0", "comment": "Malware payload (NanoCore)", "value": "2f1b36b81c47d448fe331629a39fb507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425431, "uuid": "6fbfbcf6-1aee-43b6-89c3-cfe3b98be3e7", "comment": "Malware payload (NanoCore)", "value": "a42bc65e6c8ba74256bb0325fb5848a73bf23b6f7733b5564db3794b6b6cb2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425431, "uuid": "84a75b33-9e95-4558-bea6-d9fe07a29e29", "comment": "Malware payload (NanoCore)", "value": "0f975061a69ac64abdd647123c439bcdb9226683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425431, "uuid": "453e27e6-f2a0-4dc7-9d92-6cf4f935e838", "comment": "Malware payload (NanoCore)", "value": "60e1c7d2e4e6849df8ce758a5938307ce6352b837111670c75b2f13675dec9db398e4b505120f11febd488a61b6149e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425431, "uuid": "4374461b-47c3-4215-badf-6f5cccf7deed", "value": "T123C4596812FB5628DCE0EEF2D19A41A153F41C3FFC54D2D69D8878ED297A7A0064CD8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425431, "uuid": "c85dafb2-3f56-409d-868a-643175298329", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425431, "uuid": "672759b3-1b18-498a-a356-d0261e031e64", "value": "12288:Wb+occ0Wk+bSQXos1C9/pJ+eID0DZrtvI3Vgh0:Wb+rc0WkvFs1OutY9hg3Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425431, "uuid": "4e1f7179-0070-4a7d-9f77-2062391184b1", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425431, "uuid": "09b50e99-5b47-4bb0-bcda-b97908006004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425431, "uuid": "75d81bdd-7e58-4df8-b4dd-527c429525b5", "value": "Product-inquiry6243424243PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa67b5b4-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633416822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416822, "uuid": "64c9e692-0828-4db5-bdaf-a1bb46d85e40", "comment": "Malware payload (AsyncRAT)", "value": "62599b7190af0564b68eec81cc1512aa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416822, "uuid": "cb67db8c-2f41-4dac-b7f4-7dca5cdccd13", "comment": "Malware payload (AsyncRAT)", "value": "a4595c19f4975159294e669725f8d64015d8acdde7bdb189193ab65b2e959959", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416822, "uuid": "dfc3b9dd-5662-4696-a498-a87ff65c4580", "comment": "Malware payload (AsyncRAT)", "value": "33d07c26cadd9b7c023087bde93c4486e34c7ddd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416822, "uuid": "95b82f76-5202-4b0b-9bb5-2dcb88685538", "comment": "Malware payload (AsyncRAT)", "value": "ffd9a29046843496587e3b49f91c09ac48e75cf78c5f9081483972e601e8350d0160f93d3af174ac15503128f1d396e3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416822, "uuid": "ffdac557-bdf4-434a-ba09-1f4fa940faa3", "value": "T1448109B1215C0882DD3B00FB90E5FE1B52D3F2364DCE0984765DF9B50397322A726853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416822, "uuid": "d2ceaee1-24ec-41a9-92ac-d2fe0d52fc69", "value": "48:uk/3S3uvG5r1vTuExRdtxohQ1GiLPNf3cjumtIpuVPQxodS2J0/2LJe32bF+lSua:XmhtxRdf9BUjEAVE6klBOCkZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416822, "uuid": "ce1dc027-8e25-4ef1-8499-384199f5c24d", "value": 4042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416822, "uuid": "419f1597-b2bf-4d84-9e78-5f53167f0b59", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416822, "uuid": "5f601e7e-939a-487b-a69e-8a4f535a94ac", "value": "Audio Inquiry 05.10.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51a46bd-2599-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633410371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410371, "uuid": "2b223ba7-6189-4b1a-876e-b049a3882e16", "comment": "Malware payload (RaccoonStealer)", "value": "c6af8f29ae58334bc6aacf4f4d7e2401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410371, "uuid": "a6f9231a-1ade-4967-bf18-6d2b7205ee0e", "comment": "Malware payload (RaccoonStealer)", "value": "a4e96ae6829639366a4f4ecad2a0783cbe4dae67dd27bf91e525c742a2bc19f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410371, "uuid": "f8642704-246c-432a-a97a-056520a1c72f", "comment": "Malware payload (RaccoonStealer)", "value": "8d7446c82bdfe514b51b9a5c4f9f3da60e7dd268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410371, "uuid": "3e6cac5f-628e-4367-952e-001d38add750", "comment": "Malware payload (RaccoonStealer)", "value": "6e1eb8e177e82b14a4851f3e9bafe1971e182346361720e80932545201a9d2bd3e680fdfe843ca13ec4160651ecc557d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410371, "uuid": "13c831ea-3466-4917-a45d-cc6c2d7e16ed", "value": "T14DC4F111BBE0C430E6B722B594F99378AA39BDB06B74C5CB63C545DA07A4AE0DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410371, "uuid": "3b28369e-43f6-4e61-8348-5e949b335857", "value": "658c49f2b142429657b3337ed8c9de9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410371, "uuid": "05359a6d-f247-4c0f-8de9-dafcd72f593e", "value": "12288:TXcOGDw1/6qtZ/U/nydI8lZROBPZx9jFr9j:wDw1//Z/6kISROtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410371, "uuid": "ce549508-2b89-4b11-a725-257d8ff3c012", "value": 568570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410371, "uuid": "2961a188-660f-4cfe-b92d-cc7cad44805d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410371, "uuid": "191e1804-63ae-4aab-b918-ef1d07546c31", "value": "c6af8f29ae58334bc6aacf4f4d7e2401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2228612-25e4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633442444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442444, "uuid": "23712f20-5a42-4a42-af4d-4a3a299d8572", "comment": "Malware payload (AgentTesla)", "value": "8f74ae82d335ca3c3efc39a022409b42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442444, "uuid": "f9bea8f7-f5dd-4db7-8eb7-5c6e854e2d70", "comment": "Malware payload (AgentTesla)", "value": "a5640415e3b8429b6e2d3367a4ac1e3a33f1c2865b4917fe48cddcd7c677bfdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442444, "uuid": "dcfb8c74-455a-4c7a-8510-ade2db1d3bc2", "comment": "Malware payload (AgentTesla)", "value": "f1bfcac24ac395fc2be9664b3a2c7c1eae6df17a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442444, "uuid": "1309b46b-7ac5-43c9-aebe-3458796f7ca2", "comment": "Malware payload (AgentTesla)", "value": "2c2c99257c4f5e94b8d570642d080ab3367185061f4daa98972489d632e9b6828bb491ae7323c3b5b57e46c5a12c898c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442444, "uuid": "520983ae-8a03-45bd-84d4-87a241e0057f", "value": "T1F9B4DFA422AF6F15ED399FF4141C61C193FABC3B1169C76A0ED5B4ED2E22B700A50B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442444, "uuid": "a01e3a74-2a5b-4908-868b-32a21ebc642b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442444, "uuid": "467f035d-2136-460f-841e-2f2291764b98", "value": "12288:Mxocc0Wwfa7xrqri3EEJFEx3r6CLmwBK:Mxrc0WwfGj3E+Cx76CL3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442444, "uuid": "dfb5a142-330c-451b-b696-cb69098fdcbe", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442444, "uuid": "9592e054-60f4-49d9-a798-93772c03a3b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442444, "uuid": "dc6c4163-68fa-43f0-bb9e-38c644819063", "value": "8f74ae82d335ca3c3efc39a022409b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2edd9f-25de-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633439805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439805, "uuid": "bf3903d7-1357-4d6a-b008-73bb6bc088a7", "comment": "Malware payload (CobaltStrike)", "value": "70d4e50e8c79156f2920b2485881a77e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439805, "uuid": "aedc9155-b37f-4ef2-9b87-21bacce70f9f", "comment": "Malware payload (CobaltStrike)", "value": "a5cf75e5092bf01d80ce064e03aa336b63f1cf4daba0888d936a071dc323e172", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439805, "uuid": "d267278d-42fe-4980-ad58-194de0b5b20a", "comment": "Malware payload (CobaltStrike)", "value": "23ea8fe19909891c15673ee2c5c3419c74d8d35b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439805, "uuid": "4f1acde0-d0aa-49b6-95cd-4db30dc4e477", "comment": "Malware payload (CobaltStrike)", "value": "a846a04402e262e2814e63cef33debb506a369257f8628a63df8f06e4da6f2da4d2b317fef39aa642221aa4e5b59ac7f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439805, "uuid": "d2c5d415-521b-4874-be99-871829819cb7", "value": "T1B7D4CF15222B7B14DCBC4FF6598C699093BAAC374129D37E0DE6B0EE1572BFD0590A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439805, "uuid": "966d6333-81ef-4d8e-bc73-8422cba09699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439805, "uuid": "993c160d-d235-4521-a4ae-459bede10c00", "value": "12288:DJKq8dClnc0Wsuu/ItLpBLC7fssFptV7iCkhSQ8Cyo:gGc0Wx6hXpV7Bk8QTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439805, "uuid": "7bdaff76-330d-4ca4-b93a-7b8478ea1065", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439805, "uuid": "059aaf2e-15de-49d6-b416-d8ece02bb361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439805, "uuid": "b87a5b9b-a048-4b64-9635-28102d803074", "value": "GuestKey_.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f608d71-257d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633398201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398201, "uuid": "467b197c-f3d9-4fef-911b-540c3cd50621", "comment": "Malware payload (AgentTesla)", "value": "227d1491bf0140c4ff8e8355c608dd20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398201, "uuid": "365ab137-7229-4b19-9161-fcb20e04c978", "comment": "Malware payload (AgentTesla)", "value": "a70083ec4ef2827681e4797428d06041251498725010d37c38165810d9647c67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398201, "uuid": "3ff02073-779a-4b5a-86fa-d9a4c692e26c", "comment": "Malware payload (AgentTesla)", "value": "84b82673c67ee705aaf3009420c2559329aadb36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398201, "uuid": "aad9510b-8cf9-4903-8adb-35d92fc5b9a7", "comment": "Malware payload (AgentTesla)", "value": "1bee73728231ccdbd508004159ca6f6aeec472d3666781d81acb47cb5eb2eb170cfcfb60c81b0e1c725dba55461d3e01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398201, "uuid": "2417edea-bb91-42a4-aa4d-5a6ed9a33d89", "value": "T1EAF4D025B743D60BCE3547B028EDE6005339AF111659C32E3C85BABD1E73B742A9C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398201, "uuid": "bf925319-ea6a-4da0-87fb-1f562aa7a399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398201, "uuid": "c91feaf2-5918-4226-b99d-a28411f7ff5b", "value": "6144:lkj0EW6Q+3HwOExx5GFfTvYEwRoYhv38IyWw0gs4G9prgn7zAfwTC0QwlaWJsmqJ:doTFfrrTaQsPpM7zAk/AkTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633398201, "uuid": "e0bae7bd-2902-4014-b35c-c0e0bb67ebda", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633398201, "uuid": "52bdb4e0-8190-4c88-ba2f-1dda12c37eb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398201, "uuid": "8f581269-a3a5-493a-a408-61e8c3117a9d", "value": "Ref-0052410031.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd071d8-25a5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633415189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415189, "uuid": "5244de57-17c4-432e-9cdf-9f9a712811d6", "comment": "Malware payload (RaccoonStealer)", "value": "02d6b6f3f4633a759d0bb4f5cac8e960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415189, "uuid": "05857098-b600-46ab-a608-27d1081e9771", "comment": "Malware payload (RaccoonStealer)", "value": "a83f52fc6ff5e78d2e842bf3fe48df1ab6ab668aa0be73fca7b68a58c2c37e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415189, "uuid": "aaae812b-bdeb-4667-9d8f-512aafc08c90", "comment": "Malware payload (RaccoonStealer)", "value": "543e932ea20954c5eb5b5bc2c59c757cab6edc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415189, "uuid": "9e834f98-0463-4754-b837-c91e38f3c7dd", "comment": "Malware payload (RaccoonStealer)", "value": "96a01a9eabc77830b79326126385d45361113e03658771f84e42853f0d250947c15e65202f56583c8cfa4f2cdf7e7c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415189, "uuid": "03fad887-8d00-4a62-ab90-d4363412fa7c", "value": "T15B448E30A7A0C035F5B712F489B993BCA92D7DB09B3491CF52E01AEA5A346E4DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415189, "uuid": "bc571ebd-f2d3-426e-a209-2c29957f38de", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415189, "uuid": "9bc3f421-99dd-4859-91fc-69c38c684e3f", "value": "6144:hof8qJvgHfB4r7v3O8h7we9Mgtojse7/UNUz1HRZgFO:hBc4HfB4rjpye9Mtse7sNUz5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415189, "uuid": "46669bfb-349e-4597-9284-27f2cf5b2fcf", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415189, "uuid": "994a67a6-28ce-415b-8bcd-913922c0e0ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415189, "uuid": "85efbb5e-a956-4222-81ac-8ac4ad675d3f", "value": "02d6b6f3f4633a759d0bb4f5cac8e960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3a3468-25c3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633428397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428397, "uuid": "7d37005e-ca51-4faf-a7cd-549f8c6db317", "comment": "Malware payload (RedLineStealer)", "value": "26ac6f38b111522b7802b03d1fa93e5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428397, "uuid": "26dfccc2-d645-4d01-a7d6-48df8729467e", "comment": "Malware payload (RedLineStealer)", "value": "a93c39e88748ae1c58bc46449d76159b958d2c0233f6709d13ea71f8f13a42a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428397, "uuid": "9b8d5acd-c22d-4fab-831a-411f24fe56ea", "comment": "Malware payload (RedLineStealer)", "value": "a3f0455e91db6a4f4dea25752eb0074917f50d33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633428397, "uuid": "062b81e4-3d74-4af0-ab19-98ceaefaa44b", "comment": "Malware payload (RedLineStealer)", "value": "6b3628b148214f6e6421d7b8516abd087f031df1453cbb2456ea21025cf19145a64e61750a4c80ef15fdd7496953d507", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428397, "uuid": "7318c301-3a2a-450c-8777-1a2b358bc803", "value": "T149952342BEC199F1D6710D3516BBA756B1BC22200F299FD79390895DEB344C0BF22DEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428397, "uuid": "e2a94679-523d-498b-af06-dbb93d206d45", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428397, "uuid": "74436c81-acf2-4292-8b58-8a4bdf4bd20a", "value": "49152:K84+N/rBPwIE75NxJFNiVyXixlWMolDwFDx3wKejji:KMJubVJHBX4e5wFxgri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633428397, "uuid": "92b3afe6-cf19-45bd-a428-acb71d387411", "value": 1936789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633428397, "uuid": "51743bc7-439b-4348-98b3-a8d5f2f25ee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633428397, "uuid": "9b367399-6c64-47bb-836a-a0c916b9aeda", "value": "26ac6f38b111522b7802b03d1fa93e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02e75b4-259f-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633412940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412940, "uuid": "5dbacc1e-6476-414b-bafa-f2bf64ee6da6", "comment": "Malware payload (BitRAT)", "value": "2f4f25e4803d7aa90ed41e92730f8ab7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412940, "uuid": "c7e5781a-5639-4588-8549-c4820918ebac", "comment": "Malware payload (BitRAT)", "value": "aa2b402834863b18a365b58803840f93932091638dffb9b0bae4416d448b91a3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412940, "uuid": "babda21f-098a-4914-afb6-94fd77f14b28", "comment": "Malware payload (BitRAT)", "value": "eaea8ca1058d88553b4f0556f33f215d6742537d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412940, "uuid": "55980d30-2117-4b41-bb8b-d5673781b8cd", "comment": "Malware payload (BitRAT)", "value": "7187682f540688101f31c071a8ab40d4216fc353c25d3450c1fec7d94aa852b82419acf001432b5d62274b20c4d99277", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412940, "uuid": "f33d242c-0c46-41f1-b407-efb60ac57d9b", "value": "T1DE656D3261F5853BC1E21BF2AC5F69995477BE2035146AC765EDBE4C3A34FF1222208B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412940, "uuid": "c6006b9c-6d1e-4796-91ef-9051c1426756", "value": "12288:plDYMzwNJM3m4uZQvFTt0jjqipWUUtWZPO19tT3jlin4uq8S:tKpKvFTmjjTWUrZW19tT3jlin4t8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412940, "uuid": "99e0897b-9012-4e32-b7f4-03db887e16bc", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412940, "uuid": "47f4f3a7-f361-440f-9eac-fbcb540bde79", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412940, "uuid": "26db0c90-0046-485c-accb-83b6a6e13ae7", "value": "dhlf00.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcbf814-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mimail)", "timestamp": 1633411758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411758, "uuid": "eedf6e98-f819-408b-9580-2bfd9523e802", "comment": "Malware payload (Mimail)", "value": "b2cf320fc76f7088abe8ded416339910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411758, "uuid": "09a983eb-a700-4f58-a3e1-41a0cfb78741", "comment": "Malware payload (Mimail)", "value": "aa47ee7d1967f6e316846820fd6066e7d35f4f32f7049a80781c93a3d6e2147b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411758, "uuid": "5e5d660a-fc03-413d-a468-6a13154d6973", "comment": "Malware payload (Mimail)", "value": "24bd6fb8dc9d1d1c1f89f6a2f0307f26deddcbc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411758, "uuid": "970596fc-79a6-409d-bb3c-12e752cfe4cb", "comment": "Malware payload (Mimail)", "value": "be7c6fa252548ff5cd5391feb276752d1283acd652c4088d3c90be5acae1b523194dbc54529a67aa995cd3843aa17194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mimail", "colour": "#D09913", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411758, "uuid": "4c623dc0-24ea-4b49-9520-33471e7d4027", "value": "T15B4402B3E2EF4557E15C167D0FBF527250E2C22EEBBC285D09DE9753AC52B08B8112A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411758, "uuid": "0075e38b-5e46-46f1-a0f3-c8f0a8494dd9", "value": "9c0050334da711b5147027326c52827d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411758, "uuid": "438636ee-70bd-48a4-a741-614a86adfede", "value": "6144:HTpVZ5przLzBPzueQ/VjXKrzLzBoBA8dhVrzLzBPzueQ/VjXKrzLzB:zFv3LzlFo43LzWBAAr3LzlFo43Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411758, "uuid": "42b21cb9-8db1-4b62-8773-cdd41f951f01", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411758, "uuid": "42b08b1c-c5a9-4e29-a3bc-0ec9fceb1d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411758, "uuid": "6f6e0782-f805-4672-b559-0742ce0e5cdb", "value": "coolimages.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd63806-259b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633410899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410899, "uuid": "c56e45d4-a861-4254-b57b-43cefa7fe122", "comment": "Malware payload (AgentTesla)", "value": "6d1b1ef7ae57c74c9d1774fc6a569f6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410899, "uuid": "6dd1ec28-fe0b-4110-85b2-a520294f756f", "comment": "Malware payload (AgentTesla)", "value": "aa9d6a7893252b4f32ae4c4113ef88d4400ddf09ff0ba0020c1c0385901a4caa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410899, "uuid": "3962e5e8-9463-4127-8186-9c8e15c855ef", "comment": "Malware payload (AgentTesla)", "value": "2e33c27c8c4115d60ee1cdad08282e2f9722ad94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410899, "uuid": "5e5293e2-8119-44a3-bb2b-7cd38f71d388", "comment": "Malware payload (AgentTesla)", "value": "0aa0dffc7a37bb47a2548253eeb1951d168b4ea1cd8d960ebb5f8000a9971664f298c52d7416ab806e345ef70aab9b89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410899, "uuid": "80bc05a8-eb72-4d38-a468-6850934458c8", "value": "T14CC4F13CDB634B16CF788BF73818566147B2C095878AE3BC6E88B0ED39277B5955480B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410899, "uuid": "37b0a308-6a63-4756-a139-2e91c6259349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410899, "uuid": "0d1fec67-934a-49f0-b6c0-d3c816d42e4c", "value": "12288:WL3Iotd8x8hazGh31Z1vHPcCqZK+PtQEny9NDN8w:WI8G8hazU39vHPyYxSip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410899, "uuid": "8ea1464d-3d45-48fe-aeb8-e67660a8b7e1", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410899, "uuid": "21a11452-0b73-4d1b-92cc-440b87236a31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410899, "uuid": "1d4ef504-881f-49c1-be32-c608cfae6f52", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fdb70b-259c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633411314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411314, "uuid": "0ef3f732-c675-4bb6-b34d-3c6c9f7f6a2f", "comment": "Malware payload", "value": "699627e6767e1d009332530d20b76d98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411314, "uuid": "1bed9d60-a1ff-40a1-9edf-86605e2c9d77", "comment": "Malware payload", "value": "aab667eaf76c58e2d344924d46f5b80c8146796dec3919d69baf2fa08d6a9457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411314, "uuid": "1572f633-9ff6-4fa2-8c7c-06d04bb2a630", "comment": "Malware payload", "value": "4a1c5ba16a33a21a39ac684a3f52fa2e78f33e41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411314, "uuid": "3f45d3ad-4bc7-4491-84a2-869d06694051", "comment": "Malware payload", "value": "5c57d960a8f2755aad710ae50c22b15e47e51fcf573fb033a169b7a012148a8c8783aba8dd68b5ce66d0773daf087146", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411314, "uuid": "48561f7b-9b41-42d2-87c6-5c2044562f8e", "value": "T16E15330F94917073B875A9AC06622447790B4CB38FE6B3D78789FA52213B4D25F876B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411314, "uuid": "a698ae71-d7f6-4ebf-9ac5-124820d70d05", "value": "24576:9yN1QXwX8tdgn6YHbXpVKA8zfeMqow9jxz7cdF0yaYGvwUZD:9i6Gwo5UrRW9Nzq9aYGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411314, "uuid": "8414a964-4930-4e50-ae3c-b7f974913a0e", "value": 912368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411314, "uuid": "c14a70ab-c151-43ef-a27e-abbeb0527fd9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411314, "uuid": "f61af62b-10e5-4e76-9a68-99bbc36811bf", "value": "699627e6767e1d009332530d20b76d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e621959-2610-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633461174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461174, "uuid": "66f6053a-8d09-4d85-b2a7-cf62b78cff94", "comment": "Malware payload (RaccoonStealer)", "value": "d9e940ab2ed75150e939cb6d1e2067cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461174, "uuid": "00fbc3b8-8446-44bc-8c55-690f479579d7", "comment": "Malware payload (RaccoonStealer)", "value": "ab9a992f805bce47b17d65b705612b2c88d55beafd9714c5a278be7ee09e1d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461174, "uuid": "79338ec7-27be-4957-ae5c-4f7a95f37e50", "comment": "Malware payload (RaccoonStealer)", "value": "cebc5a49414706d1d4a572a6c04030879c286bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461174, "uuid": "76835b0b-40d8-4616-a2c6-95f9ae48b77f", "comment": "Malware payload (RaccoonStealer)", "value": "f792a8f8bfb3cd805f45d29d60440be57a4a6deba5a60ac3646a86f5907efd22c40fab8f603e5214ae92f52d43f3e35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461174, "uuid": "b6d1a9ae-4546-41cf-986d-8caba898a4b3", "value": "T15DB4E110A7E0C035F1B752F9457583B4A53E7EB16B2891CF62C61BEA9A382E4DD31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461174, "uuid": "37939963-8f7f-49eb-85b5-feaa7c017394", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461174, "uuid": "4ffcb3f2-dd35-430e-8159-cc5b6c0d1715", "value": "12288:OK9f6Y7B/lyGAFjF3wUtpIGaGQZFzDGGZU4ENpfX6o:v6YplyhFZpINGQzyx4ENpfXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633461174, "uuid": "d566a630-183a-494d-888d-f8a3d18e970a", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633461174, "uuid": "89939e1a-95df-426b-beb0-fe7bcd96a7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461174, "uuid": "58bd4182-deb0-4800-92f9-4b531c63e279", "value": "d9e940ab2ed75150e939cb6d1e2067cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00d9f2b-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633411651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411651, "uuid": "62cc6914-8526-4714-a437-49e730a76f41", "comment": "Malware payload (Neshta)", "value": "986021bcec991cf8e2e30c14b59f68ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411651, "uuid": "c767d344-8b68-46cd-8628-18218d585a50", "comment": "Malware payload (Neshta)", "value": "ab9f07758d73614eb4b307ffe5f88e28c62ffdb94a011874dcc2e992fd0e2ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411651, "uuid": "cd44c23e-ab54-4c43-869f-87d0900bac65", "comment": "Malware payload (Neshta)", "value": "ec06450569675fe896382de46a465b0118256ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411651, "uuid": "19c7a818-390e-41fc-99ce-080d161554d8", "comment": "Malware payload (Neshta)", "value": "02f4381f6da46960c4486c6abc2f335685f9745b92fcadaa8098a09003bcd31f475519b8eb33b89a406a65763ef3356c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411651, "uuid": "465fac33-6382-4393-9031-dec963775233", "value": "T17905D064B747D607CE754BB028EDA3405739AF211A49C31E3889B7BC2D737A41A8CDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411651, "uuid": "4f00e1c6-8340-4e35-afe7-8176d05f9851", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411651, "uuid": "5f83179e-aba8-4a60-8645-ddcbac91c2b9", "value": "12288:ko14cey6H12qv/MEChCP+FeAVeIEvH4Tsq:kfDyDa/MECoP+xVW4Tsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411651, "uuid": "a2eb191d-e295-43c1-ac73-05d798095c3f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411651, "uuid": "964d1c15-7332-47b4-94ac-f75f4a38683c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411651, "uuid": "1a8498d7-b32b-4523-b641-e78ac2358464", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de9272d-25ad-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633418788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418788, "uuid": "4bc7ba5b-5487-46ce-bee2-d388e6d445b2", "comment": "Malware payload (RaccoonStealer)", "value": "9a0a8e8171cd3ffd3e13d93809a4bdde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418788, "uuid": "7ef6bd01-5c9f-4570-a473-c85183592edd", "comment": "Malware payload (RaccoonStealer)", "value": "abcd86df71b0dcd29c9fd43c17efc16763dadecac5e071d588ba6c409e536e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418788, "uuid": "3365ae61-332d-4f6b-a08a-5765cbc46f79", "comment": "Malware payload (RaccoonStealer)", "value": "73a8447b6a37ae1e5fe83b11f7253e259cc6e1d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418788, "uuid": "8450b72c-59e1-4920-9148-07227a13c75b", "comment": "Malware payload (RaccoonStealer)", "value": "0a159a2665cb664c24545caff9ff3341cf50839a0069bc8a3f4c68f50c893b86e70884180c09e145eb18095f85252d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418788, "uuid": "3f85aac9-4163-4500-af5e-3e6e0390362f", "value": "T19D448D30A7A0C035F1BB12F449B993B9ED2D7DB19B2490CB53E01AEA56346E8DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418788, "uuid": "6f0e7bd8-14d0-4814-8fda-330fd797721d", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418788, "uuid": "ced54841-501d-4c25-9a41-f080b3f3b1ed", "value": "6144:PovxJvg9QM1wruzOxQ7bXpQffjd3rw8VKuFO:P+/49QM1wKw8XpQT9/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418788, "uuid": "8714b224-c67f-4365-a94d-30b59da9b4b6", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418788, "uuid": "f52291fd-1b00-4ca2-b9c5-cae74b6f288d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418788, "uuid": "5e1f1315-8e67-41ec-9a78-3832086dae71", "value": "9a0a8e8171cd3ffd3e13d93809a4bdde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e406857-25be-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633425956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425956, "uuid": "e9e991e5-dc4d-4932-83b5-2bf6f915fc5e", "comment": "Malware payload (RedLineStealer)", "value": "9fcb4d89d7756b915028d95b3b14d6dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425956, "uuid": "a5fead4c-15f7-4431-98d0-ac3e6700897c", "comment": "Malware payload (RedLineStealer)", "value": "ac8cf25a55659954e3c2bdf2a3b53115f139be50f049a424015ab28232aea09e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425956, "uuid": "ff7e500c-495b-4452-891b-fd9480e86c1a", "comment": "Malware payload (RedLineStealer)", "value": "df9bd6bbf5d1662f69e97a472ca484c9eb4cac3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425956, "uuid": "4579e2ab-f2de-4db1-87e7-fe04fe688319", "comment": "Malware payload (RedLineStealer)", "value": "17329678eed1b99e00492ed6b9f36c975fb4ac095b81eaf28b80e3f9699ccc1274a19d083d612861763ff8b5ddaf81b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425956, "uuid": "ca257642-cf28-471f-9bab-baacc9e2613f", "value": "T126E533A07AE040BAD28510399A487BF780FAC34927715AB37394C91D9FBCC5AC91E75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425956, "uuid": "5fcf0407-2589-46c9-a924-67d829d07125", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425956, "uuid": "d2dd1937-1177-4fda-8916-38eac8c9c729", "value": "98304:xKUDkC9tILxeyR8dpffZ1U0hWsNVDCvLUBsK05k:xWCG05Z1Hh3V4LUCKWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425956, "uuid": "c9024b6b-196a-48da-978f-917f4c9e000e", "value": 3232158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425956, "uuid": "c8e7a02d-d390-445f-94d3-faeb5aeb88a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425956, "uuid": "9a128e04-ab79-4699-9eb1-4a6c155e1641", "value": "AC8CF25A55659954E3C2BDF2A3B53115F139BE50F049A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134d8500-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633454230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454230, "uuid": "a110d36e-31be-43df-a9e9-1b646b4678a5", "comment": "Malware payload (TrickBot)", "value": "f159ce3c7bdac4c2686f2d36986539c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454230, "uuid": "267f837f-8a10-42ca-9be2-9579bd888e55", "comment": "Malware payload (TrickBot)", "value": "acf725f1ade6bcadcb9f0ded2d0ad8e6cac553a19acbaf67dd95c133623594e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454230, "uuid": "abf6c4f6-5a6d-405d-b144-c0f0ce343e65", "comment": "Malware payload (TrickBot)", "value": "3078935817d58b6fda4bf0b1ebcd0c6ce675c1d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454230, "uuid": "c28ac1c2-e53e-4daa-b57e-27acd03c1e71", "comment": "Malware payload (TrickBot)", "value": "00943cef788338c0c985417a303cdbc7f4975c437d0df7d6ed8a9839a780fe6eb6387b3dbe935cdca7c8678d6724aa84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454230, "uuid": "a0722ba8-fed7-4745-94ef-3cd6d5020710", "value": "T14FF4BD0631C0D07AD5E221F1CED1EB295AF99E928B290FCB7B90F91E6E366C04437756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454230, "uuid": "371b304f-6945-4323-bdbc-320ee0ad888b", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454230, "uuid": "2d375f05-6db8-4b51-bf40-1c0495c10f82", "value": "12288:dBx+M4F6CM2pEbihXZGrVmrtz0rAK97lF/ACLy/Yw:dn4gCM2GMX1ZK97H4CLyQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454230, "uuid": "ff0ad165-4dea-4ced-a59b-2a314e99ac55", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454230, "uuid": "46ac17ab-7ebf-4666-aae2-d9adacd631f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454230, "uuid": "19046763-eeb5-4274-8e54-1bc579cae7e9", "value": "f159ce3c7bdac4c2686f2d36986539c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d84e47f-25de-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633439832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439832, "uuid": "7f34acb2-9aea-4b91-99c1-3f0f50554c21", "comment": "Malware payload (Gozi)", "value": "c54eedf9395c48d7e5fb8742c57242e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439832, "uuid": "25e11cfe-7de6-489d-a92f-2fc28090ea9a", "comment": "Malware payload (Gozi)", "value": "ad5eba504d2c84b8b0a89ac424ca3982e59b57b6cef100d743b5051d2bdba340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439832, "uuid": "2d535a60-532d-49c4-a084-2f92ad3a306f", "comment": "Malware payload (Gozi)", "value": "96afe924c35a0c5a22c3ce9a8a7344313470597c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439832, "uuid": "57d6aaab-ce62-455f-93a8-c9487be6e2e9", "comment": "Malware payload (Gozi)", "value": "bbbec5351bc35fdfafd9b4debc82f711891c9ddd50b5e6bc0164638e635bf5efefae61458f92e6d72331525ef9085bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439832, "uuid": "2ea8efb2-7f10-4269-883f-c17681305553", "value": "T124346D6AA2E50A95FDB7D5B9CD93C617E7F234490B64C35F13B0CA566F43321B218381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439832, "uuid": "8999ff62-4cfd-4e18-9a33-2e77f5e5d40a", "value": "6144:1mnZO0GDlypHAT/cxkDyPFXkfh+3m33c5cWjak4SyS83x:1MZOrEpHAT/cLPF0Im3s5cWjaCf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439832, "uuid": "555cc115-3683-4660-a617-248170b7fa7c", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439832, "uuid": "26718870-f449-4a6c-8e66-17a9f7d2b5c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439832, "uuid": "4b33c206-49db-4fcc-8b43-80123472842d", "value": "1520000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84b4f00-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412094, "uuid": "a2f32fa0-3b33-4dd2-b3e6-b465d20b506c", "comment": "Malware payload (Gafgyt)", "value": "ff48370a2a94ce3676b73ecfe9c0c7ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412094, "uuid": "d08a7e3d-8b6f-4b36-9a4d-3e1a3189b08b", "comment": "Malware payload (Gafgyt)", "value": "adddf72596dacb26fc78c63b32eb1a87ebe75ec78ac6e7973e8600da2b1b47f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412094, "uuid": "bb50cbfd-da39-47db-964f-1b6cea25fcf2", "comment": "Malware payload (Gafgyt)", "value": "c943c1d8ecce175558bceb0533967842a8ce50f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412094, "uuid": "f58c9864-089f-41e2-b16b-5fd6fde710e0", "comment": "Malware payload (Gafgyt)", "value": "86a6c13193c07193d96852cef5643f3d0636d346c2352e856b4295c02d717b91af6573b151f403225dba1eee5e662ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412094, "uuid": "e23aa3b4-f898-44e5-88a4-182869ecfb30", "value": "T113734A43AB81CAB3D0431AB516EB9B210232F87E5E1BAE51F31C7DF49B150C87267769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412094, "uuid": "d6f45f31-e750-46a7-b4c1-d5c33cdc8d03", "value": "1536:gcI/g99UjUWdxkLOzf/q1oajmzDKasExTe8mogPa9ZwmLItVOCjXZRshS:dIY9UjUWgyzfyyajUDpsWLgmwmUtVOCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412094, "uuid": "c341f265-254f-4b73-ac1d-a8dc395589ca", "value": 76786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412094, "uuid": "29074860-4d6e-4024-b667-ff2ad1136558", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412094, "uuid": "f60b825c-90e2-4580-a325-e81accac2fc5", "value": "ff48370a2a94ce3676b73ecfe9c0c7ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fe5639-25c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633427551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427551, "uuid": "201553a2-a8a3-4c7e-8ed0-85567c9d8d32", "comment": "Malware payload", "value": "e7c85909bd98c3b3d5b1cd85f55023dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427551, "uuid": "a30f7e9e-ebbb-42ac-9ae6-b3179350808f", "comment": "Malware payload", "value": "adfe4bb2ea2462bd0a996d8152a239c69354975ff911c80c1ca5bec6f63fb076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427551, "uuid": "e1f3da1b-374e-4f37-96e1-ca355fe92c9a", "comment": "Malware payload", "value": "064dee66e1770d4e094b76d2127fa6675a646a14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427551, "uuid": "99bbadc7-a951-409d-a830-47a10817744c", "comment": "Malware payload", "value": "41166dd9130d1ed3018cf936d40b01fc081249d6e9cbdf6e59e857fd4081929708a69b7526e5e0a202424232de9f57aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427551, "uuid": "2a61447e-d290-4f61-b741-6f0ab3e3e12f", "value": "T10C952353B4C104B1D5B1193912DA97B5617C3D202F249BE793987A2E6F700C2BA37BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427551, "uuid": "e9f04747-ccd1-455c-9ff6-d28195a99b18", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427551, "uuid": "f2acaace-24d8-4507-9627-aa5007e864b7", "value": "49152:5unKcQRDlD3e0ufj+XYrbPehaZ4Z5Nxf5fM+5CIdAe:5KCtlDOh6Yuh5nfFbC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633427551, "uuid": "db956a8b-49fc-4088-8d44-5ea89aa08dd5", "value": 2057300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633427551, "uuid": "de67bf16-d466-4f37-b8fc-98ed1cf210cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427551, "uuid": "37a1dea4-6e21-4a94-ac6d-ce4b31afa362", "value": "e7c85909bd98c3b3d5b1cd85f55023dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e490c72-25bb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633424640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424640, "uuid": "ae9923b1-8616-448e-870d-4b7a2c3b34ca", "comment": "Malware payload (RedLineStealer)", "value": "ee98c1f6708926a136a805fa80652733", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424640, "uuid": "4e1dad55-6be9-4d80-8dad-e0d2765dc38b", "comment": "Malware payload (RedLineStealer)", "value": "ae2a26a5e871dbc441b4e9560820a311f8db50ebcacb2b451838d8ff71d42b93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424640, "uuid": "562384df-7096-472c-85a3-6193fc678f1f", "comment": "Malware payload (RedLineStealer)", "value": "8c7ecfc3a4b98edf311ab010d529b5c171491176", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424640, "uuid": "199ba681-71a6-4aa1-8724-30cd84e02084", "comment": "Malware payload (RedLineStealer)", "value": "8523854751fdb44d39ffe205b54226e766fc706dc4b87141f712b209455ae9170a537ad662c147f114b9269339fee586", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424640, "uuid": "faf8122a-e03b-4580-a941-053f4aeae16b", "value": "T184756B25A07BC56A4153DFE23CCC58BBE999D9B7689C313312A8C30BCB52798DD171B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424640, "uuid": "fafea086-cb51-4c58-88e4-b00f996d54f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424640, "uuid": "b130b4af-a6ae-4dc7-9dda-db19ca32683a", "value": "3072:VRv6fym3lbuDonmi5gQMC3qf2umy4TkvGTKwBQ1gHbvS9U+Z92PkrC08PrPduww+:efT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424640, "uuid": "557b2598-55e4-43d1-be2b-8bafad2481d9", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424640, "uuid": "0e205560-089c-4811-a424-6404d67014dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424640, "uuid": "3175da28-de19-4918-95f3-3135e0123ca8", "value": "ee98c1f6708926a136a805fa80652733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d0972b-25d0-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633433942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433942, "uuid": "058f6d0a-edd8-4871-a003-a60649862d2d", "comment": "Malware payload (ArkeiStealer)", "value": "aef5ca656d4ff3b53bfa4acb9e500e5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433942, "uuid": "7f7f059f-b6b3-49cb-9217-4779926298d7", "comment": "Malware payload (ArkeiStealer)", "value": "af01014d5078e186ff588ce207c9f4d52413834d791bb6a4dc1d5d9c7155f6e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433942, "uuid": "10c74a44-f307-4570-bcfc-61df2d4f7a8a", "comment": "Malware payload (ArkeiStealer)", "value": "484d8acef38bd8d6edc0a9ec2a7617fe7175f72a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633433942, "uuid": "fbf39b00-4c23-4cda-bca0-317f7c167add", "comment": "Malware payload (ArkeiStealer)", "value": "2535836ceb6c20db1b0c652852f633c5f7c6a5c27a830f8f856bc38c718072a22962e093a28535e05989f633c0bdc68c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433942, "uuid": "cbbafb43-6dd5-45f5-9abf-7ebb77ed912a", "value": "T13DE4F120B7D0C034F2BB21B549BA93B8A92D7DB1673485CF66D56AF946B86D4EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433942, "uuid": "bbfd380c-4228-4589-9f8e-21422303600f", "value": "bec5279be0cb3c653f5b0b143b00a99c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433942, "uuid": "217720fa-9271-4b69-9f3a-df9ff867d9ab", "value": "12288:QFrYOMhsFwHpYWRXJCmDX1Hr8ShSD1bPGLZlxLnRHgPgmz0tSylKnkU:sasFIp5CmDXdrXED1AZLTRHgP/QtSy8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633433942, "uuid": "1bf6a1c4-5ef2-48c4-aacf-814abcb8e056", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633433942, "uuid": "5eeea8b8-0f49-4239-bdcc-ea083cd8020f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633433942, "uuid": "109cdcfc-4da5-40ef-bafb-da95fb8648e2", "value": "aef5ca656d4ff3b53bfa4acb9e500e5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34646aec-25f6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633449991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449991, "uuid": "51c85fef-d7c0-475b-b5e6-c5854a8b8ab9", "comment": "Malware payload (RaccoonStealer)", "value": "f30a4dd80754827952e98733bc2ca29f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449991, "uuid": "e6a26d3b-d1d3-422a-afa1-b01b5189fa25", "comment": "Malware payload (RaccoonStealer)", "value": "af3a3e08e6aac8a4438f6a0453042ef57148887d1c74751a77a5bbef6d5e87de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449991, "uuid": "ef68c773-451a-4c1f-a419-84f94888aa0d", "comment": "Malware payload (RaccoonStealer)", "value": "d43dc7d6647609a7fa0a1ca55cc8f2013e6a0643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633449991, "uuid": "dfb22d66-d5e5-42bb-8825-71a41d6fdc2c", "comment": "Malware payload (RaccoonStealer)", "value": "7bc42f3d82f306ec3fa595c031d7a2565308b7ebe217d85c853fb1fe6a75b1efd781997bbc953d9e1fcab1104ca542f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449991, "uuid": "f0a43e2d-b515-464b-826f-fa8b507204e5", "value": "T16AB4F11067F0C031F4B721FA49B9C3B9A42D7DB16B2441CB62D52AEA9B396D0EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449991, "uuid": "af325905-f979-4032-af82-06375871011a", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449991, "uuid": "691d2eff-ddfb-4846-b4ac-1a264f613d00", "value": "12288:mEkC6y6T5MXWK0Ei3jPngQWGeuJItjjuebj1U:l6ywMb0nD68J8bj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633449991, "uuid": "5fc7a11c-2e70-4d21-a383-0876275544f4", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633449991, "uuid": "2f4b5b1e-6fe3-4c4d-9845-83362f1a2aa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633449991, "uuid": "5f92901a-8898-4960-aca4-094931c06aa4", "value": "f30a4dd80754827952e98733bc2ca29f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3092f6f-2630-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633475141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475141, "uuid": "73a0c7ef-2c5e-4e5f-983c-1503569a8fdf", "comment": "Malware payload", "value": "f82443473e360c3354c6f0ceea3c0cd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475141, "uuid": "b6c08647-71ea-4787-baf5-cd4cabf2e79f", "comment": "Malware payload", "value": "af4593e9f1f7ec82eab6d8bb3f66b14f30c6a166095fa807624c0a7e42ea63ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475141, "uuid": "f5ec18c9-ce6c-41eb-a705-93dd11a7f03d", "comment": "Malware payload", "value": "b5ff27b664d1a72546a5beac98053335dbaad2b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633475141, "uuid": "e5b13560-4e27-40ac-93ff-e2e8f88e69fe", "comment": "Malware payload", "value": "56cb95f927c0e814ff2e1ce16a7183c5581e7584f6717d29a9cb2a30385d94a482c2097e888ffb3e56dce8a9126cdfbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475141, "uuid": "cf9ff4fc-a3cf-45cb-b667-55fe96464aac", "value": "T118A4BEAD761476EFCC2BC676CAA41C38A69074AB432B9207A42341DD9D0D9C7DFA11F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475141, "uuid": "439e67c0-0a80-46e4-93f0-c0ec045d9377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475141, "uuid": "122a51d9-f770-47ef-b41d-bb833cc21478", "value": "12288:a0sgGrW0auM3dPhZnmR5Z/GTtJ0r5P8zo9bSf62XXCVpzWctqkQlb36EZ5:a0FQnzM3dZdmTZ/+w5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633475141, "uuid": "a4736049-4b37-49e8-8059-35242bccc906", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633475141, "uuid": "1f9624c4-0692-4b3e-aaa0-b65c7de49dbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633475141, "uuid": "9700d65c-c66b-4f20-80fd-e7366fa774e6", "value": "OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028f0292-25fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633452484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452484, "uuid": "5fc47e09-7f9a-4862-a293-dc751521dfb3", "comment": "Malware payload (Formbook)", "value": "3107a2ab38734f234d4fed885976d2b7", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452484, "uuid": "426951df-1508-45c2-99a6-1a6c75855df3", "comment": "Malware payload (Formbook)", "value": "afb0dcb294330abe26a2e2611f36441607a878844a251bea8be3e9407e238ad8", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452484, "uuid": "b881b056-f517-4622-9c1b-caf0bc7c3326", "comment": "Malware payload (Formbook)", "value": "0e2528335349290ffa2f8ac46030fcf3412740b3", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452484, "uuid": "23d888e4-0321-4407-9754-3924993ab3d3", "comment": "Malware payload (Formbook)", "value": "1412836a3056b9aae199af00d0b61dbf5c912ec483a447daec766716209a821b6377564a062b0ddf061e1f0030882205", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452484, "uuid": "5ae5bb04-51f4-4909-861e-3d5d120502aa", "value": "T102B4CF94336F6F45ED398FF4142CA1D153BA6C372079D72A0E92B0ED5962BB00E91E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452484, "uuid": "edf18d6b-c932-4efd-b592-b278565ab611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452484, "uuid": "9fdd92a8-0b71-4318-bbb2-488caf090f3e", "value": "12288:B8occ0WSM3CAniwHakxk3yCFFp55uQbNnZbeJ3:B8rc0Wrzi+xoy655nZKJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452484, "uuid": "bf6c179f-fe93-4f46-b5a0-6519ce05b3cb", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452484, "uuid": "8ce1f998-0cae-4f68-a067-6ade9656f4ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452484, "uuid": "cc2d2fb0-9680-4fd2-9c12-4c2ac721919a", "value": "Factura de proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674a1560-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633411851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411851, "uuid": "83101043-148e-4b1e-b9f8-678ac9b6de29", "comment": "Malware payload (RedLineStealer)", "value": "42f8ffca5d83f382c5447e6306ed0cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411851, "uuid": "4427df35-8f7a-4b06-8fd2-3383b4cd9fce", "comment": "Malware payload (RedLineStealer)", "value": "b0ecc4c8d95995f882061dc5913166dc540ac9acb448b56354477bc6e1d78023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411851, "uuid": "4a632864-3d3e-406f-b7c8-45cb9a0e0929", "comment": "Malware payload (RedLineStealer)", "value": "d671cdcc500dd45c4769aea376c8a76396fdfe47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411851, "uuid": "a1dbb8bb-4369-4607-9811-6c3851007f12", "comment": "Malware payload (RedLineStealer)", "value": "1d26c3eeb06954f4da158a8daf9285d69babcdc9cd2b780968d02ca45baa68b2061c04e2275606ddd2884a72ee57406e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411851, "uuid": "6cd16ea4-6c45-460b-9f2a-9067a167f4e6", "value": "T19564AF30A7A0C034F1B712F44AB993B9A93D7E719B3890CB53E51AEA56346E4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411851, "uuid": "8a76738e-fc0c-4350-8689-74fbcaa471a7", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411851, "uuid": "d5b99e1f-cbfc-4d69-8f32-2e0f5428d867", "value": "6144:hoTNJvgx8AGo0aTO3G77rdzM3YvIekgOb0bKL8zfOJqCmp5nFO:hKz4x8AGoFWerdz/vWv8KYSFy5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411851, "uuid": "4ded7cf8-0fde-4e2e-90f3-eb37d82288c0", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411851, "uuid": "465e3250-f4d4-44a8-8842-d9eb745cabea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411851, "uuid": "2acf01b8-7f5a-46e0-a145-91f783ba67b3", "value": "42f8ffca5d83f382c5447e6306ed0cdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e136c9-2629-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633472186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472186, "uuid": "0cbc1622-22ce-4f4d-8b51-3efe2bd5e59e", "comment": "Malware payload", "value": "5587ca95384fd66688235bea2e5a0c81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472186, "uuid": "e608ce2a-703d-49b2-b8ac-55a72627d76b", "comment": "Malware payload", "value": "b107df92ff500ba6ea60893330131d3365f30691593c0ab4719578ac3b44a14d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472186, "uuid": "064081f2-9e6a-4fbb-9283-62b0604dd9f4", "comment": "Malware payload", "value": "5ab45ff215d9563c7338bba39456d3b78b887989", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633472186, "uuid": "7e6503db-c06f-4641-bf0d-9b7eac2de89f", "comment": "Malware payload", "value": "8f68a2e56659418bae6b9fe8776ae8944eb5fe49428656a20477c0f35640a3502d7703a17deca925694064763bf9f994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472186, "uuid": "b69f4e7d-7a39-4a59-ba94-993a38766066", "value": "T111549E306790C036F1F316F856BA9379A52D3EA2A77490CF52D41AFA4A346E4EC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472186, "uuid": "9232b43f-1c20-48a7-8240-00e2cba84391", "value": "af44dcafed165daab29f132f710193c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472186, "uuid": "f325da5b-aa95-4557-88ca-89550b6c76c2", "value": "6144:/LmhaXrxJHCx7HdqAT7mvs/bNAk3B79Nm:/LmhaXrxJHuHdPT1n9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633472186, "uuid": "1109f73f-866d-43ff-bc72-57825e3073a7", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633472186, "uuid": "557cabb2-bb88-41ec-8ee3-ebcf0532b63a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633472186, "uuid": "ac3705e3-e9f8-4764-ab9e-e274d47020ac", "value": "5587ca95384fd66688235bea2e5a0c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5a65f4-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436956, "uuid": "df2d4b92-b235-4919-88d0-1e0cfbf25b17", "comment": "Malware payload (SnakeKeylogger)", "value": "1ac009906a25ca6639fcac406d2fca98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436956, "uuid": "63551941-12cb-464e-ae6c-a012b38a6e6b", "comment": "Malware payload (SnakeKeylogger)", "value": "b182edb787d497eeed41880c81331d9dee8ddfa00813672bc77f7b09a2528981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436956, "uuid": "1db04169-398b-4168-b4ad-2dc490d6e907", "comment": "Malware payload (SnakeKeylogger)", "value": "c80b72cf8f51bac9e2a9c45fdef11b7829a489b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436956, "uuid": "87e7e871-e917-4c77-9b6e-7278393411db", "comment": "Malware payload (SnakeKeylogger)", "value": "df1e300154c239d8bd03ba962a9f93add70df4a26eb46a2eb6b5c4ed116d6604a976ddecc53506d0961476d058868565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436956, "uuid": "dece0ace-bc39-4482-ba4d-70057943bd2b", "value": "T1AEA4E03CD6230B46CD3987F7386896914BF69095828EE37C6DC4B4F93DA3BB99160427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436956, "uuid": "ebca7279-73e6-4c69-a65c-142cc494611b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436956, "uuid": "3aceeb88-8e4e-4fe6-a766-d69963de797e", "value": "6144:Y7KsvQ+3HwOcKU5HJ2gP8eEQ4e3NzgVywVkXc87X7lUWHR7yRrJhXK8DAi15TIw:YOsIocfHZ8er4edqzkTD7LHFy9NDN8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436956, "uuid": "52741331-4685-4ca8-87d5-ea98efcbfa8a", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436956, "uuid": "6ad96b18-653d-46c6-990e-7b5d61808f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436956, "uuid": "85680662-50a2-4424-8281-ccc5eb354081", "value": "REQUEST FOR QUOTATION.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812cb249-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633437664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437664, "uuid": "3fcb6d9c-c602-4e7d-be45-668f126f3610", "comment": "Malware payload", "value": "e16e5ef0f8aa1f18f70c6dffdbd57dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437664, "uuid": "382a12e6-f0c9-4d4f-b82d-0bef662603d4", "comment": "Malware payload", "value": "b1ce2f968ff7b3105e312eb2882b1edb57365d112339bcc31105d6bea6f22f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437664, "uuid": "f973b09c-f61f-46d7-b545-fdaed40413cc", "comment": "Malware payload", "value": "6a0eebe5e95545610a5312f470713bc79529154f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437664, "uuid": "94542622-35e3-40aa-ba39-8b2b015889ca", "comment": "Malware payload", "value": "3319be76ad537c9fc959a9e7ba82ec3ec048ac521ec892b4a64f11ccb1969c09dd6d0076dc18633ea76baf680bd2092d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437664, "uuid": "fe170835-f8d3-4568-afdf-b30a353853d9", "value": "T1CE07186FA9A68578C11EC17BC0B29F04A43370F92737C5FB936805682E91AD44E7F729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437664, "uuid": "04b04f4c-14d9-40c1-b909-72c11fcb9807", "value": "0cfcab64810d743e764ab5419cc8d92f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437664, "uuid": "30688a6f-e459-478f-b1ba-9b81837bc01a", "value": "98304:j+HAPir/L2x6Mq9VQfnO4Ydo92ImITP5J0/Nsr7/iAXflijzJk:j+SWL2x6DaG4UPY1Xf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437664, "uuid": "4dec86e7-7e15-423f-b065-68ef4c14914a", "value": 16830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437664, "uuid": "135d8746-36b7-4fa8-8241-9df423467c01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437664, "uuid": "2d6bd756-6871-4783-8066-9404a7774879", "value": "ligue1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3f48f2-25a8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633416666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416666, "uuid": "f72bb9e2-63a6-43ce-b0c9-7d4b0aa48901", "comment": "Malware payload", "value": "e07ac5f78dac0c6518674f86feaccdfe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416666, "uuid": "83e25288-5bca-49c9-aace-f19dc08deb3f", "comment": "Malware payload", "value": "b29105acfa3e647d470cfd170e13e9924d46ff1c34c282dbffe1b39090694caf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416666, "uuid": "9cda653c-ad8e-474f-b3c2-a57a8a301ec7", "comment": "Malware payload", "value": "1a9ecee8c503663b71966a2597d4069a8e758b63", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416666, "uuid": "3ff3f0c7-4c4f-4c7b-8369-3c680902380e", "comment": "Malware payload", "value": "73d3a52af9b298264b9691fcdfa7b0f8fbf9984affb0d9eb09866f8d032b5f729b2deb8b7a3e11a06c151c52f55c7f2a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416666, "uuid": "375baee2-b570-4160-9fa9-cb3078d398b5", "value": "T197C57D22B2D18437D0736E38CD6B6399953A7E602E38984F7BE45D4C5F397803A292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416666, "uuid": "53a078b4-3678-402e-8bf7-e1603bcce2c0", "value": "49152:ZxN0lXQxzFXS9iucqZ/a8foD92GxG3TP+hZOYLEA:5fRXUiusIoUZeZOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416666, "uuid": "0e9d0dd9-bc5a-410c-a7a5-ec39fa40d2e7", "value": 2542592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416666, "uuid": "97bccb5f-c078-47b3-9c3e-40016a9567c9", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416666, "uuid": "d447c2d0-8a2a-4e24-8cee-56411e2c42a8", "value": "tskaeiizitwtkdeyatfbarlnuwfkqcehakjtrwczxakvikuimumdcqncgx.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2b12a7-25f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633448425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448425, "uuid": "bd9c14ab-ca57-438e-9735-08936f303821", "comment": "Malware payload (RedLineStealer)", "value": "c74d6082f58f27ecb3cc7cd6865f4582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448425, "uuid": "01ec9bd6-b2a2-4e66-83d8-3e057132e3ff", "comment": "Malware payload (RedLineStealer)", "value": "b295f373692ed2609880b45f02c74bc99e235871fef4d5ddb8cf8db3ef8b4c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448425, "uuid": "c028cfff-a281-49d2-8a1c-060f09b95e2d", "comment": "Malware payload (RedLineStealer)", "value": "360f5cd681b6dcd80a49f4f28edb27b766f99b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633448425, "uuid": "066b0707-c6d2-4822-82ac-b4dd4dc7e130", "comment": "Malware payload (RedLineStealer)", "value": "f50728f78ef3ba28afd06c21835ee4a3269aa11f413ff92167233943479927513882699197e25e2bb723fc146983469a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448425, "uuid": "d7db7e02-4f5e-40d7-ad2c-8aaa23cf04c0", "value": "T18864B010B7E0C035F5B712BA497AC7B4A53D7DB0AB2491CB62C62AEA97346D4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448425, "uuid": "ff283a08-edb7-48f2-8ee3-47cfe82eb4a5", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448425, "uuid": "150e40dd-0eb2-44ba-b899-e0c756e77bb9", "value": "6144:6oKeB6GNUJkrIniPmPOA9lTe4NboVjmF2amz+sU:6teB6GNU6IniPOlTeCgjGmz+sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633448425, "uuid": "fbb901de-d508-4a06-bbb9-83057cbe09e6", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633448425, "uuid": "f4e86e05-d9c8-41b3-a763-a4ec3b5df954", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633448425, "uuid": "17c1e8da-24b0-4f02-aa59-0d8039ae4807", "value": "c74d6082f58f27ecb3cc7cd6865f4582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c545ef-25f1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633447874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447874, "uuid": "28f52274-cdfc-42ee-9213-e7051e9838e6", "comment": "Malware payload (RaccoonStealer)", "value": "d5e9637371ce1a097c2f17ad0813dbb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447874, "uuid": "87bef25a-a223-46cf-8d03-1fd0403913af", "comment": "Malware payload (RaccoonStealer)", "value": "b2d75da0ee95724fa0509732685d0da4369dd469828da82d96426ff878fe2f75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447874, "uuid": "2c4acefc-1245-43ff-a4d9-87f3bb6e3348", "comment": "Malware payload (RaccoonStealer)", "value": "fde18da1c026bbd2bb2bf41beaa75a2a40ec2190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447874, "uuid": "36311c9f-7ad1-4225-a5a3-2747822a03b3", "comment": "Malware payload (RaccoonStealer)", "value": "5ae2fdf26c79d885897ca6223cebc300005f04a5bcb167e668e4246e594b04a1e51e03bf91143843513d37a3a4aa2ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447874, "uuid": "ec30446d-6ff1-4931-89c1-7b21fcb82555", "value": "T1E1B4E101BBE0C035F5BB16BA497AC3B465397E71AB2060C712D92AED8A347E4ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447874, "uuid": "d16883ba-9fd4-44f1-88aa-94e0bd9efb0a", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447874, "uuid": "cf280837-89ca-47e0-a3f3-927e2c54dc68", "value": "12288:s0EA6SFzZM3Wd1DvBR9FbXgNi5Bh1kAv8SypBe7ox2Q:p6SrME9j9Fgw5jv+MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633447874, "uuid": "09519c01-10cd-49df-ae05-b2ebd665da21", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633447874, "uuid": "8a2ecbeb-b530-4829-b231-477fe2c5e946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447874, "uuid": "843d460e-3755-4a02-9172-d10781e6e7f9", "value": "b2d75da0ee95724fa0509732685d0da4369dd469828da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cbd68a-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633440997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440997, "uuid": "bbc3a0e2-3f89-44cf-8caf-aa948105f320", "comment": "Malware payload (AgentTesla)", "value": "7d0acbe554dec218af1fe54b1904179a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440997, "uuid": "a1dc7be9-a04c-4842-902f-fbaeddee334e", "comment": "Malware payload (AgentTesla)", "value": "b4579c5c68f0acf10dbd90c0a6e197f59ef2fe77d7afe82bdef0ad0c5fda1437", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440997, "uuid": "60c6a39f-203f-49a1-8589-82ad77db16d3", "comment": "Malware payload (AgentTesla)", "value": "8b0177cb19457b21560eeeb9b5f021181a3bdcbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440997, "uuid": "3e96bceb-1bf4-4848-af47-61ad89b3aca7", "comment": "Malware payload (AgentTesla)", "value": "20203be00930c6fb85f9c3ba955c4dcc01cd238a502ae98c8bf851b7c7ec974d4cd24760322eb23ae0c6f86c06f86787", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440997, "uuid": "aee2ba69-580d-4e05-ba34-d55fbc69c7f0", "value": "T1E6159D90D2038CA4FC298BB5683ACC354227BE79EDF9911D3A5DF2652BB33C21469D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440997, "uuid": "ea02a784-6b9e-4fd0-ae7a-bd1c54d63ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440997, "uuid": "9419624b-dbe8-4f2c-b811-f150a8db121e", "value": "12288:3yIo7x7KEIHkMr00KhdhA7LNyl7uwzy9NDN8wc:CIoGkMYd2s3ip8wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440997, "uuid": "d758dedb-6b60-4d8b-b18f-1c01e0d02b3b", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440997, "uuid": "e7444db2-0eda-43f6-8e5a-b35bf7c08b00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440997, "uuid": "d1415edc-65c5-4714-b540-d0ba9d98e18c", "value": "\uc740\ud589 \uc138\ubd80\uc815\ubcf4 \ud655\uc778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84c9940-25ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633418537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418537, "uuid": "2cf1fc18-70bc-4577-9474-edf9bc687ce1", "comment": "Malware payload (Loki)", "value": "82878be02fe6a67ed47a89dac51640ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418537, "uuid": "098a9681-c573-498f-8cbc-ba5caff2d1e8", "comment": "Malware payload (Loki)", "value": "b46f7602c782bcf3d9c3d7a75b40d317f4479f69692da614161781020999424e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418537, "uuid": "6c4070cb-ed06-4a19-bcfb-52d94a13c37a", "comment": "Malware payload (Loki)", "value": "e83a28998a6776283e5c3987e4fa892b1486be55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418537, "uuid": "0cf93fe5-4dbb-4f83-a6b5-517004ff526d", "comment": "Malware payload (Loki)", "value": "aab49ea8d613302eea79cbfbc2b26f5e517852e75d8f9c2b591c02fa7d589310763d9042d5a71f95e8910da18dc4257f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418537, "uuid": "0748d1e9-df7f-4b15-8686-8ec5e6d496ea", "value": "T12C441212A2D281FFF0D35AB09E7663BCF3BD8D644194A56F87984E763F347135A09212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418537, "uuid": "0c961c9b-55f4-4851-9409-d697ea6a9ce8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418537, "uuid": "3858eb13-9e3f-4fb8-bf17-cdcf5b9d95b6", "value": "6144:F8LxBs9jMm3npI76Qm0+2PBDWEEnADpTmshzeD//WZ2eEy:/mgk1l+2pDkncms9e7/jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418537, "uuid": "2887a608-b8fc-4598-bb1a-fffd337ed632", "value": 260656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418537, "uuid": "9d3095d8-3745-4528-bf01-5d5a579a8126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418537, "uuid": "9fba3c66-cc27-4800-98ce-72bf94f35760", "value": "82878be02fe6a67ed47a89dac51640ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46c4114-259f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633412893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412893, "uuid": "3a531309-64e1-44b1-ad12-4abbc4fccf9b", "comment": "Malware payload (GuLoader)", "value": "dc69f097dfb6a7651f068a1982a642f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412893, "uuid": "03470916-250c-4303-b316-0a01d0237bb7", "comment": "Malware payload (GuLoader)", "value": "b5d87cdb3f13e7bc9c7f834bf6e752ffe87955cae39da67b5cd915cf5e25a797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412893, "uuid": "484872ea-3f08-43d2-b964-b3b0a5ffb49e", "comment": "Malware payload (GuLoader)", "value": "2d8ceb5156657d71687f172bdc17b02157ff3e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412893, "uuid": "4b57eb34-42f9-434a-837b-84e08a0d7ca4", "comment": "Malware payload (GuLoader)", "value": "a7d29bec73735a0374cdce458a85fb257b0a56ffbaed9c7dd8584c8e79879ca75a3e12a271ef1d1613cf171b2fc12c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412893, "uuid": "1acb4509-385d-4fa4-92fe-512005cd12a3", "value": "T10DA3C231F5A0DBEAF811D6FDB731F0E215F1AD62DA91590B31883F0A75F60C669E060A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412893, "uuid": "fd040ee2-ee4b-4c98-95c2-499464765188", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412893, "uuid": "42550a83-2c5c-453d-afe0-dd4179008537", "value": "1536:tkQmJkFFrb/vRwZ2qw09SVrI5SqN5LvX1GQFT:tkHJ2V/vRwZ2qhStIAqN5bllFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412893, "uuid": "cb35650c-de31-44f9-bafd-e2c497ecb112", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412893, "uuid": "267e7e34-fd1d-4bef-831d-f83d0a3bddc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412893, "uuid": "7ed47611-36db-43dc-8b04-20f25c2b3a72", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1512137-25ef-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633447274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447274, "uuid": "4e361034-5b28-4b56-95f8-9b10acb8b54b", "comment": "Malware payload (RaccoonStealer)", "value": "9b0399599fa9a1bbd73249fdfd40496c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447274, "uuid": "f6bb58e2-ac17-4250-aef8-2cceba180e4f", "comment": "Malware payload (RaccoonStealer)", "value": "b648f4ad072e317ca9d4d63ac7ead7f73e3bf955a301f06a2ca6ead6a673f148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447274, "uuid": "d1420c12-b374-4d24-a1dd-37ecd366c0f2", "comment": "Malware payload (RaccoonStealer)", "value": "2cea34e2351fed6cf190a7fedf924ac982f7c09f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447274, "uuid": "8d1e5aff-a319-4a17-a4c1-6a8964ddf2c2", "comment": "Malware payload (RaccoonStealer)", "value": "de28a76349a54d91b2c40cfc27c5ba72d9c0b8f3fbe961d02018cbd7123fcd5a75f22ebc083bf4d966630b683e4d2029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447274, "uuid": "d2ea5f56-be02-4605-9e7c-50b7440b8f1e", "value": "T132349E10B7E0C035F4B722F9497983B5A53DBEB16B24A1CB52C12AFA9A346D4EC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447274, "uuid": "584d69f1-e61d-4e08-a743-2fc30e26a162", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447274, "uuid": "a95fd608-7ef0-4942-a262-9ea13879f144", "value": "6144:zoVC+64OdxEkrQVmfd3LFEmJ7ePHvm0Zx7:zeC+64OdxVQVmfLJ74O0Z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633447274, "uuid": "0c475d32-008c-4aee-9dd8-dd6eda50a710", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633447274, "uuid": "f8ee6563-4c77-4bd8-8a69-6ff59411ec6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447274, "uuid": "21152ea2-0729-4a9d-a4dc-1369fce5dedc", "value": "9b0399599fa9a1bbd73249fdfd40496c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58be3026-25b7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633422993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422993, "uuid": "72e01c11-c5da-42be-af43-2d2da200cd16", "comment": "Malware payload (RaccoonStealer)", "value": "aeb77431a4dfd0524268d812903ee047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422993, "uuid": "b506aa7e-e403-406c-8544-fdf690f60dbc", "comment": "Malware payload (RaccoonStealer)", "value": "b64a2b0e48995cd72c55b2ff5c0ada0f5002ce13966e643736c57d57087f8725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422993, "uuid": "29b30d72-0bb9-4c64-a66a-850b9c785c94", "comment": "Malware payload (RaccoonStealer)", "value": "c98ea28ab4b6135764bdfaea3c52ad2ea36588cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422993, "uuid": "b82548c1-5dde-4134-bc15-071f723d7b26", "comment": "Malware payload (RaccoonStealer)", "value": "1108ba55bd9647afad0d71c45774a0b666dc65634030288e4c7ae013c36bf0b025b6386f7add66a8f72d22e4ba2c095e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422993, "uuid": "902bb6a7-d322-4c4e-8603-b43117fc8c14", "value": "T193B4E02077E0C038F1B751F648B5A364A93DBDB05B3891CBA7E11AEA5A78AD0DD30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422993, "uuid": "9c01e7c3-186f-404b-956d-e1221d95e06f", "value": "64d7f5246a1a432e8ee086e976e37133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422993, "uuid": "fd03ebcd-fc33-4b1e-8e50-c8adbab65b2c", "value": "12288:Ys/4oKYb/Vac/2zI6Ir4jV2pRIk6fWAUmqcD7xVEuj/bcUH:Hnb/Vv4ar4jVw16OApEu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422993, "uuid": "56c92d32-8999-4d36-95d6-065a52794829", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422993, "uuid": "92533792-4c47-45c0-bc9a-82313617352c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422993, "uuid": "9239cde4-d2be-486c-84da-a11d55f18687", "value": "aeb77431a4dfd0524268d812903ee047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fa4f7d-25d1-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633434258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434258, "uuid": "9f18a34a-4bd3-4212-ad4e-98f63bf527b5", "comment": "Malware payload (ArkeiStealer)", "value": "5f251ddf1f41eb3ccc330508f173152a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434258, "uuid": "cfedfe45-0933-4537-ae05-05c33351bebf", "comment": "Malware payload (ArkeiStealer)", "value": "b7bd5421b8f7404d03566396d802acd841f32156f4d6195338249d677ce8224d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434258, "uuid": "3cc07869-8332-43de-a258-602a5be0aa11", "comment": "Malware payload (ArkeiStealer)", "value": "658b2f8a1e737860f1bfa4661a9c80bda3c7fa97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434258, "uuid": "7c5a296a-3a37-4ea1-a4ba-1caf70e84263", "comment": "Malware payload (ArkeiStealer)", "value": "425e22729beefd13951a6d7b60323b38b8b354b4814cca6e68b97f274c3b72f606125949e660599ac6323f25f379dda9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434258, "uuid": "72c713c4-1435-4752-939a-1c972472eb05", "value": "T133351878E1CDD827E36936B495D38E6E44292C8CFC0246CEB75B2A9E6A39FDD7C05005", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434258, "uuid": "06ff4d91-2910-49de-97c6-83d3d8e660cd", "value": "08dbf1a5c98fd4931a5aa7dc687e7799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434258, "uuid": "4a52c6cf-8c05-461f-842e-16a220cb926c", "value": "3072:GP6X6qcNEUzZELeUoPxwAnjaPM76DBQ+E0RqfUE+kvHTz96K6ScIOj3K:GPcukLvBlRqfR+2Tz96KncIOja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633434258, "uuid": "2d439ed9-d526-4353-98de-b174a9156f86", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633434258, "uuid": "9d4e7357-5c44-48d9-a438-7d2d0c34561e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434258, "uuid": "124e0d59-22a4-45f0-9483-7d689acad710", "value": "5f251ddf1f41eb3ccc330508f173152a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1848e3-259a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633410675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410675, "uuid": "0858f46c-9d40-4db2-afb7-b9fd7ef39ab0", "comment": "Malware payload (RedLineStealer)", "value": "6381a61b20f2aaf197eb755cd2df01e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410675, "uuid": "22025f45-17ba-4305-99a9-403a4dc530cf", "comment": "Malware payload (RedLineStealer)", "value": "b8c8e867dcfa50dfeabea00664412ee359cf7780f9205abffb1462b4e1d5eb6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410675, "uuid": "eed6a27b-d42e-4180-85cf-a0fc347e3885", "comment": "Malware payload (RedLineStealer)", "value": "d2ba852bf59f581734024014dcc76b9f56d0093c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410675, "uuid": "7dc29361-ba08-413e-acd9-35d210c81e8c", "comment": "Malware payload (RedLineStealer)", "value": "aca1505f6ca71564d8379a093e18f13329252e629946761a574f39cdae29febefca22098b4baac5a6935627d59efaf86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410675, "uuid": "82263387-afb8-49fc-8350-767184f5d17f", "value": "T1EB94BF21715B8A72D07514310AF9EAF6196EBC760B6F25EFA39453BE0E303C19633A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410675, "uuid": "4dd0befe-44ca-4bd6-9989-ae08989d7e5c", "value": "7e6d410cb0ee9d4d9be8ad4e6fd75b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410675, "uuid": "2f72235f-214e-4ebb-93e8-a56604cddd91", "value": "6144:xEmiiXciCHxrkxzhlDv47GdmGYcTCZAOuMsMOtQjwRTvLq4gWCQnfWhhYZMy+:xpbsiCHxrkxzhlvCA/tQjIjbaYZMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410675, "uuid": "19c7aa30-6b0d-4aff-a1de-e0700f92994e", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410675, "uuid": "e9c31bd5-12d5-4dba-88c8-49166e421aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410675, "uuid": "b62a2415-3c09-431a-8fdc-56e652d4e5de", "value": "6381a61b20f2aaf197eb755cd2df01e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a9525a-25b0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633419984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419984, "uuid": "30e2d66b-70d2-4e87-974f-95e2a293e831", "comment": "Malware payload (RaccoonStealer)", "value": "da8e75c67a71c916966844714aad55e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419984, "uuid": "1709fa15-8d31-429e-849f-5609193b0340", "comment": "Malware payload (RaccoonStealer)", "value": "b8e0ead3346147c0e9e85f231ec2333e1fe91d52cb083539cfd42cc5286e5e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419984, "uuid": "3fce7a38-8852-4eff-ba58-a5d4272ddb9c", "comment": "Malware payload (RaccoonStealer)", "value": "6055ea424f9a4cf9b2086269ade679c65ef56d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633419984, "uuid": "eec71264-dee5-408f-a1c3-b53e09cad18b", "comment": "Malware payload (RaccoonStealer)", "value": "88b0e2819ede1f0d7601cc740473bd58b53cee61483140c6bba3dde2bdabb2f094db237dad52cd4c473487d796f3b355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419984, "uuid": "6028d9f6-9c26-4e17-a39f-eeab54099307", "value": "T1A4B4E130B7A0C035F4B712B549B6937CA92EBEB0973491CB52E41AEA57346E4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419984, "uuid": "226ab0ad-1228-407e-8356-860ac425b6d6", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419984, "uuid": "b9fb405c-f46c-483e-bc6e-b30b74854d8e", "value": "12288:RMB45eKWIxomtLpQaPVT0qpN/slfqoiOl/cZJ8MIKN:mixoSKaPVT0gyiIcIMIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633419984, "uuid": "7948e7af-29d1-43ad-af99-efdd66ee81fb", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633419984, "uuid": "79c032cf-4ff4-40a8-8fae-3024fad57125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633419984, "uuid": "44c598fd-338d-41c0-a2d0-3d8b44d961d2", "value": "da8e75c67a71c916966844714aad55e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af37d71-25e2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633441385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441385, "uuid": "b3eee3e6-5b0d-44e4-b24a-34c1e4aca020", "comment": "Malware payload", "value": "40f5282728af8a4ca1059788010b287e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441385, "uuid": "4c6d5fd4-f252-4951-8829-581a9cff7fe5", "comment": "Malware payload", "value": "b974c4344ec187e6c3a763317faec68872d613802fc3ee273dceb1032ea1a13f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441385, "uuid": "01adce36-7273-45e8-adfe-54dc2352cb7c", "comment": "Malware payload", "value": "bce3f8abf0f3bb483be7be50961d923829072f65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441385, "uuid": "352f7f3f-01b3-4792-9cf3-351162f35941", "comment": "Malware payload", "value": "9cb62e61859f3911d2561f51626afce04e1faa999b564d793b7f419bf1540e207f44b3566c4e7482ade3ecb37ef44641", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441385, "uuid": "33bbe318-3aa3-448c-92f1-a1fa8ca67354", "value": "T1CD73C402A6578DCBE5DC50301CF6C38531A9BD84BF88534332AB7F1D2F7A56A96D3286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441385, "uuid": "b9ed32e6-a02c-448e-b963-ec8bbd4ab4a6", "value": "768:Rj5jaXRYRsLTlMTnOfRqAtg33pwLgbtfAlySXntQ0B9mbUmjFVX0UioTwlR4YB8V:Rj5jaXJQgmTX0rdqMjHFbJpyJ9Sma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441385, "uuid": "efb43c73-e7c5-49d8-8353-78a16e701251", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441385, "uuid": "348ef9d3-083d-435d-b3b1-ba48155ebfc6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441385, "uuid": "1958dbe2-d355-4252-8ffe-a850a53f7413", "value": "material 010.04.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98dcbe0-25c1-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1633427558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427558, "uuid": "aaa38f6a-243b-4a31-b419-a2d54cc4fb34", "comment": "Malware payload (Amadey)", "value": "61f9521aba6003796e3e2544dfdb2596", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427558, "uuid": "ac87ba0f-f2f2-4ab4-aa86-ae951f74b612", "comment": "Malware payload (Amadey)", "value": "ba9fb85fdf253d76f2e1b1ae1e96b45ffb31ac9f8b7d7b4375e1616a0f4f2137", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427558, "uuid": "8af3be51-db91-488d-85d5-de46b9ee8d8d", "comment": "Malware payload (Amadey)", "value": "97dfc70b065b94478edbc161f92ce25c5c83f1ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633427558, "uuid": "9a9b9580-911f-40a2-8c8b-c51ab657f416", "comment": "Malware payload (Amadey)", "value": "2f26d90fc081cb69a54568a508566e89902736368138b6df992ebf8ea66d4bc2d7591dafcdbe01257218afcac90cbe8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427558, "uuid": "b2053208-4186-4b8a-a5ac-62cff552846b", "value": "T1CD54BE10B7E0C034F1B712F589B983B8A93DBDB06B3495CB62D51AEA56786E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427558, "uuid": "03f71876-c9d4-46d7-869f-8eeca2a06192", "value": "69d02296fd41d5fbc6c18775cf2c5cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427558, "uuid": "8f057c12-ff2c-4e5c-a355-d2512403fc07", "value": "3072:+M2fuoyOUQmS5v/nt6KjuJaKEbxPTQZOs3rU0vyboxILrA8Jzk6ZJsxLsDx2hhKt:+MMuF3Q75HgIINaky/ZALgyUjZVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633427558, "uuid": "fb71b3f6-8cc0-4d6b-85b8-14926aba9005", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633427558, "uuid": "f7f709a0-afbb-41d7-9d11-9ddaae5d3b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633427558, "uuid": "292a2671-d2de-44c3-a6de-bfdb7b376142", "value": "61f9521aba6003796e3e2544dfdb2596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a6596-2628-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633471566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633471566, "uuid": "884d7a86-39eb-4cf7-9f60-eb2678576716", "comment": "Malware payload", "value": "ef10abba744bec8ddc37cef69365d061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633471566, "uuid": "43813ce4-d825-4b08-8264-72235e50cf93", "comment": "Malware payload", "value": "ba9fe1f154b98085f694fc4eee4fe19b0337d304b1cb47633b566beced96df93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633471566, "uuid": "be3ea0cb-128c-42dc-9919-e9fe6c60bca5", "comment": "Malware payload", "value": "6e46309b7c378acf55cdc01746be42ed403661a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633471566, "uuid": "de3a2fb5-34f1-414c-ba5c-46a2abca58a1", "comment": "Malware payload", "value": "133dc7749384e16bf70c9f6a26572858dc8bc889e58edfdc2e370f4355b8364bd8980b5deb923357577e58cdfc0e9213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633471566, "uuid": "6b76a569-4bbc-4235-aa39-aa288df91135", "value": "T15A2419566755D521C75F417FC01AC20831F1EB07972AD38F5AA2D8FA1B822CEF92B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633471566, "uuid": "04582caf-9900-4fb6-940c-7b76adf62983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633471566, "uuid": "32f425ea-0a2a-4d3f-8f91-d8bd9f87db1a", "value": "3072:YcQVkCKsDM+xdRuR3opteueNg26MoUAHmPwNh6MaOAe8WC8RjD6wOLpqMOJqeYUX:KwRY2uemZUppiKwWbLp4gHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633471566, "uuid": "a17030ab-02be-45ab-bdca-55a28d03e282", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633471566, "uuid": "4c0c502a-613d-45d7-95f9-1d51d45bd454", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633471566, "uuid": "3b7083ac-966a-48a0-ac80-d3f6bd9dab10", "value": "QYRQtZONGOaChQIuWnOgHwNfXphqsTaz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80470a2f-258e-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633405450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633405450, "uuid": "32ed473e-fc0e-466e-b698-0e9dbf8cb65e", "comment": "Malware payload (DanaBot)", "value": "ed3dd342054d04d320ddba1d821c53dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633405450, "uuid": "549e45a7-5d5c-4ab0-88eb-1ef48a977dd8", "comment": "Malware payload (DanaBot)", "value": "babcbf266a1bbb8c6ce3f339d767abb78821c0d71663186dafe7ada1da74e118", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633405450, "uuid": "b8fbe53a-82ff-4a03-95e9-dda6fe223923", "comment": "Malware payload (DanaBot)", "value": "e53e7aced0df1ffd8f202e62988df1362b500d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633405450, "uuid": "72647067-8d98-4b0c-b9bc-8f57898fe0af", "comment": "Malware payload (DanaBot)", "value": "d91b0984dd0e7d86097554dd3806f9187195982933d9e1499df380c9ffceb5418b4a1cfd6706bfdbec27d040d1c51117", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633405450, "uuid": "b9c8dd9e-b52f-44c3-9052-fa141e997304", "value": "T160451230B7A0C035F4B362F858B693B86A293DB15F3492CF16E11AEA52756D8DD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633405450, "uuid": "f987922d-f184-44b8-8211-eb6a19129dfa", "value": "7d2b5fe056f9f1898f2b12424a66461a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633405450, "uuid": "a8c08d1e-4a18-4738-a439-8c1a1a2a7db4", "value": "24576:vO/oDz9FWN7DI8WDydPgzK8kcGSXLS51Y8Rmh2Rf0VYs0:vZzPsWDz3GQSVQVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633405450, "uuid": "56f8f43a-8bb3-4068-b103-b916a371467d", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633405450, "uuid": "4271abe5-62d0-491c-974e-a37c10f0d5ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633405450, "uuid": "a4d52821-c0dc-47fc-ba1b-76b9479383e5", "value": "ed3dd342054d04d320ddba1d821c53dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17885e6d-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633424173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424173, "uuid": "cfb5d667-8a18-48bf-87bb-12254786b525", "comment": "Malware payload (RedLineStealer)", "value": "c66c7d3a9faf5923345aa158f56b7fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424173, "uuid": "e3066ba0-26c9-4c59-8832-123ed12a08ee", "comment": "Malware payload (RedLineStealer)", "value": "baf599abab1d6969e1ba455f83375cbc9643bbe5049189729d3ce60be08e4a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424173, "uuid": "c7b9d729-7c87-4157-922b-ab0097559074", "comment": "Malware payload (RedLineStealer)", "value": "aa6acf4113461ddddbbfea34ac27bf392a414dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424173, "uuid": "9e9a7e9f-a91b-4620-81b4-587c3b354a5f", "comment": "Malware payload (RedLineStealer)", "value": "253c11638ce2e3908620c057aabc09b743361a07702eb29c2712a39553b2c3e0535038c255a93f41937a25c6caa9cc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424173, "uuid": "05831b8d-01f8-44a5-a5ec-b7328295e647", "value": "T14826333486F0AB87EBA306786752CCF811EF2F20EA337BC4939486A57D9AD5513187D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424173, "uuid": "22a9e961-1af0-4173-bbfa-778d60d2fa6f", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424173, "uuid": "cccc636a-e95f-4141-a99b-6e5a3f4a84cd", "value": "98304:yp6IoPXt3m4rSFhgOhxYZRqoYD//xboZzjGX59RE+qspwvfZ:y8Ioflr0hzYkoqEefVwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424173, "uuid": "33673d29-8352-4024-904b-61ad0dcefcf8", "value": 4643814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424173, "uuid": "a2a8a758-6c3d-40ce-9185-24af009967cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424173, "uuid": "18f86419-2832-4e94-9210-43f1bff48834", "value": "BAF599ABAB1D6969E1BA455F83375CBC9643BBE504918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8eceefa-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436952, "uuid": "5f2ef6cc-9e38-4cf9-bf51-06f82b090f60", "comment": "Malware payload (SnakeKeylogger)", "value": "f2c2b99d80940c399daf0f2811fcfd6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436952, "uuid": "780b6f53-67d7-4a0b-bb2d-477444dd2a94", "comment": "Malware payload (SnakeKeylogger)", "value": "bb0a5c65a726d195190a55d8394740313ffcff0425442efd8dd05e107dd8f3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436952, "uuid": "a07a04f7-dcc1-4a30-9838-7e56480e1928", "comment": "Malware payload (SnakeKeylogger)", "value": "bdc5a9462d42d1e0aa9fa8c9fe6049d228edd356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436952, "uuid": "143562cf-698b-457e-8391-b36fcb347b4c", "comment": "Malware payload (SnakeKeylogger)", "value": "259a0d80dda80a64d3a9d224539bf3742f7456690e23bbe143d52e65c0e29d6a2995f7e03ad46ff57055dfa11b17e3bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436952, "uuid": "274d4376-a997-49d3-8291-6e1b079a642d", "value": "T10E94BF9833AF6F45DD348FF4185CA19143F67C3B117AD72A0ED5B0EA2D22BB04A91A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436952, "uuid": "afa79095-a72c-4d35-ae1b-d85b22f146db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436952, "uuid": "54f0e717-36ec-4069-8604-f514184180e8", "value": "6144:jOCUf7MGmWZnh1Q+3HwOcc0WE3SFsGjhilJcQBFNv9do52qVF6adCBiMa2pfueZk:T4eocc0WKSyGjklJnbUV8adCYGpVZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436952, "uuid": "456e758d-8973-41a7-b344-29a3c023b4fe", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436952, "uuid": "63fc035a-f421-44d5-a2ab-679123dffb84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436952, "uuid": "a03476ee-0e7a-407d-a584-41d2a83fc53e", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bacc2c-25a5-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633415491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415491, "uuid": "74cb3bd5-26a0-4f82-b48c-39abbef2aa70", "comment": "Malware payload (NetWire)", "value": "45d08a387b1efad11500b3c4d2473caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415491, "uuid": "2cd73229-a62d-488c-868e-7a3bb65992e8", "comment": "Malware payload (NetWire)", "value": "bb2431cc949b6910c1c99af8d71ac7d7f874ab0a83d4208cca5402683089368a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415491, "uuid": "2c2445e6-403b-458b-b762-4ff749a0ada5", "comment": "Malware payload (NetWire)", "value": "d5c8d93930ced4b9cb591883d43fcc40e4530ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415491, "uuid": "136cdf2d-2506-4e61-9828-b6317aea8366", "comment": "Malware payload (NetWire)", "value": "e432011c1019d7646636f2c76ecc1154b863f31ece067c0c589f67c3f436778d4c2d5efdf0ed08216308d6f7e0443049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415491, "uuid": "b3a73fe6-8da0-4338-b32b-a4f504d308eb", "value": "T15754BF113592CFF2EA67053069E5CAF4973ABD5D3A22714B7790371F5E392F28A22342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415491, "uuid": "5d796cb1-4563-4c22-bcd6-86533163fc27", "value": "8edc63b1e502813168c877f42e306db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415491, "uuid": "9d134872-ccbd-4a4c-879d-67071ff165a9", "value": "6144:k+9/RNgvH72FnMCpbrq5mSn0zl19pDJO:r/RNgvHiFjpgJn0B19b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415491, "uuid": "df732ece-a07c-48d0-a61c-a2c0a4dd28a5", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415491, "uuid": "54c4b9d1-3562-4071-9ae3-892616b19371", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415491, "uuid": "32ea1ac9-8b4f-49c0-a385-c54415142785", "value": "DWG-PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19aade43-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633424176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424176, "uuid": "5a4a8d8a-554f-4ead-b37d-d25ea0b2e4bb", "comment": "Malware payload (RedLineStealer)", "value": "865159a2120a6a3b080130159b7871ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424176, "uuid": "a04f38cb-5d9b-43b5-977a-fcca892dab8a", "comment": "Malware payload (RedLineStealer)", "value": "bb265b16d6c6dae08bbdf4e7798fe06aa676ac4a8aa9a0278a15115ed6005bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424176, "uuid": "4585d724-55ce-4190-89a8-21054297a97d", "comment": "Malware payload (RedLineStealer)", "value": "5802a7233668eac573c5b8b464d95007d262c68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424176, "uuid": "904929da-7a57-404a-801f-0083d254d7ba", "comment": "Malware payload (RedLineStealer)", "value": "eb62c7e17bfac137a903d94006b31466a34e0491ef102315cff40e83e185414e74e61eff2f250c0e113b5ff4730db616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424176, "uuid": "e4c7cb52-ab18-414c-b2c0-3505e984227d", "value": "T1AB06330036A6C1F3ED8322B3D5097F7A54BFC78417129E8366C4E6480F78629E27F59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424176, "uuid": "5d450673-3a67-44dc-8efe-62dd32d75ac2", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424176, "uuid": "882c7446-4ab1-40ba-92a3-db3e86ffefa8", "value": "98304:x4Y1sblALCY+24/UdyFv1JhJi6ahqoEwn7lb:xelu+CE1PJhoEwn5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424176, "uuid": "09278c02-0d82-423d-94b5-a7522c5c00c9", "value": 3702271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424176, "uuid": "4d8f7482-f395-4368-a148-07ab0705f968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424176, "uuid": "1cb4af77-b1e3-4fa3-923a-e066e9bd1e5c", "value": "BB265B16D6C6DAE08BBDF4E7798FE06AA676AC4A8AA9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e638a7-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633412149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412149, "uuid": "3ddbf924-855c-43d6-aefe-056b65120e48", "comment": "Malware payload (RemcosRAT)", "value": "bdf800c5cd0f8010c5161bc801a4944f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412149, "uuid": "443d6c77-44f7-4f5b-b828-879cad3930af", "comment": "Malware payload (RemcosRAT)", "value": "bba5c5738cb5e83793455f2fd91f77382197d36ef98c4a8580814f9da29da9dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412149, "uuid": "4aed153a-8eec-4344-98b9-ad3655d196c4", "comment": "Malware payload (RemcosRAT)", "value": "13859414f4a5bf9be9b614336867ddf762700fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412149, "uuid": "8ad4c05c-af97-47d5-b6d4-771d23a29a39", "comment": "Malware payload (RemcosRAT)", "value": "fb5bfb5229ec880010d8102a4b6aa732b0ef149b5191890350e699ce9632fbabc8ee877c5d8cf3f4e7202f59602b5bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412149, "uuid": "1048bc92-2aa4-4f2a-8465-0e28e3c46edd", "value": "T19FA23A45FB989362EAEA8AF3D8F3D2C043F3A3560823C71F54BA17556D037598F62650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412149, "uuid": "76bb38d7-13cf-4dfc-8c8b-c67c15ea20c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412149, "uuid": "38780f81-60e8-46a7-b543-abcc0e310512", "value": "384:lYdfsfaMS7y8hkQoKnOuOV15mZpP9yDgYOjn16xnWNwc:lYdfsfTS7y8h1oKnOhVrCP9y6jngnMwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412149, "uuid": "7389d18c-9888-4dae-b25b-c6cf2d164d5c", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412149, "uuid": "fa34be23-e921-457d-9639-8421bfd9d20b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412149, "uuid": "bcce080e-8b0a-4695-bb41-b64b610768a0", "value": "Please Confirm Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf6dce7-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (YoungLotus)", "timestamp": 1633411322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411322, "uuid": "21d50f1d-ea65-444b-8f75-e80d0e8a88ff", "comment": "Malware payload (YoungLotus)", "value": "47c116db3f0e5d536352aaecbbc7d6b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411322, "uuid": "37033dcc-3e64-497f-9f5b-06dcf53e7d3a", "comment": "Malware payload (YoungLotus)", "value": "bd5f19d54c0d5de713d609653e64116e07af8037a322f803850c9cb1e6a03c90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411322, "uuid": "bdca5925-be16-4a81-8ed3-b9c3cdf49740", "comment": "Malware payload (YoungLotus)", "value": "9aab8a86b946ba6eaf513206e1c594fda27ae646", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411322, "uuid": "3e83bf1a-5e9b-46db-99d5-5a7b3a6d0fab", "comment": "Malware payload (YoungLotus)", "value": "7eb27c4be30c4ceaba89b795f49d3a8c628db937664f7eb173a137b03b88c46aea1aea0226b0cb520db592e3026c5944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411322, "uuid": "6ebf26b2-8541-42ff-8bdd-5a50c500caf7", "value": "T148E3025B11C388CFF41976F789125306A8E3163EBFA3863EFD32C6872AB5583955C5A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411322, "uuid": "f7e8cc45-43f1-42a3-b372-09494da5bab2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411322, "uuid": "f4a2c0b4-06f1-4347-a400-0b6e15aec228", "value": "3072:Y1HXx5/ddPgS99gzAMuAwUJJRD5jw2YBc7ipa+P/5y+mgZiTnBz/n2:85/DgfnuANJRDK2Y7/5y+VsZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411322, "uuid": "091562b6-63fa-4d49-9a77-2c1bfe8bb0c5", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411322, "uuid": "cd1bdb87-dcc9-4cde-a966-b00613feba55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411322, "uuid": "75772816-9228-4635-b660-6e73da31f839", "value": "47c116db3f0e5d536352aaecbbc7d6b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f29988-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633442018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442018, "uuid": "693bcd23-d990-4eec-bfc5-b12a5d00ccfe", "comment": "Malware payload (Formbook)", "value": "4c7f34b23f003c872c8f2d05fc76ce15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442018, "uuid": "a6393453-6054-43b9-a700-ca3b329c5432", "comment": "Malware payload (Formbook)", "value": "bf8bfab0557ff010ee03db046d493da9b0deeaa5e5fb55d9e5750f280a0289ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442018, "uuid": "81f7d911-cf75-4758-ab77-6d8987e2d26c", "comment": "Malware payload (Formbook)", "value": "d9b767d6703a8ed0d99e666c360a104c6dd4c1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442018, "uuid": "1ba9722b-7b89-424b-b92a-11140ac90105", "comment": "Malware payload (Formbook)", "value": "e7e4b5fbe0f0d22ba85d67589620b373dff062aea01257a142ffe46e4329733d39143be8afd8b46805d8e959d94fcae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442018, "uuid": "4e9bd07f-7f74-46c5-a773-1533aa3ba00c", "value": "T1D544228566E6CCE7E9934F714E75B73BF3B6A00B01A15E0B07994F3728614C7A83C289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442018, "uuid": "2f969730-5de4-48d4-8de7-77acd3593ba7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442018, "uuid": "84199749-d1e2-450f-bae2-83707fa973ce", "value": "6144:F8LxBs942PDUJUt9bTNAjvaUmBs1N7NFC2yekzdddOC:/942PDUut9NAzXZ19C2oddwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442018, "uuid": "6b6f9701-8f65-464a-87a1-cd4c83793a61", "value": 266883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442018, "uuid": "f123e28b-e364-45b7-a30b-a30579baa0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442018, "uuid": "042ea1a3-476b-4bbb-85b6-278abac5d5a4", "value": "FanCourier54488203expediere doc202177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18701176-25dd-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633439206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439206, "uuid": "022d4f6b-2b04-4bc0-a827-cb1df3fef9dd", "comment": "Malware payload (AgentTesla)", "value": "e373ae92858a270a9499b9ee085701b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439206, "uuid": "df8f8db1-c4b4-448b-b5b1-8c8418b384a1", "comment": "Malware payload (AgentTesla)", "value": "c047b1706fd680651800d79042e5ad2443d13f94c96ee0e74e128510845a4dbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439206, "uuid": "c7d8befb-38d7-40b3-9881-3e91c7d1f0f1", "comment": "Malware payload (AgentTesla)", "value": "34169e5fd22d55f8a65f650107ee4b505a61f7e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439206, "uuid": "012cf73e-c561-456c-af21-b9aff1db6cbd", "comment": "Malware payload (AgentTesla)", "value": "f55db58e5ba9ba304b774c5e9e8f6fba307fad9b7926cd6c9ace2fe0173331965fc3461e75356e3618d1b3df362d041c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439206, "uuid": "89a067b3-118f-453c-861d-8fcb8444e570", "value": "T1DDF4CF64B747D607CE7547F02CADA600533AAF111649C32E3889BBBD2E73774268C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439206, "uuid": "c07c1a37-ac1f-486b-a5f4-35094971c35a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439206, "uuid": "42cac822-24b8-470f-b6af-d067eb96015f", "value": "12288:woqsH1CcDySqgnSB91GEgaOWLjQUVI9aMbz:wsIcDRTSB3GEga3gKIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439206, "uuid": "0a4dbce0-68d4-4c45-b78e-f360d03734c0", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439206, "uuid": "505175c4-75ea-4104-ae4f-300d93d85301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439206, "uuid": "34ad5475-8d82-40b7-af88-34e67a99df13", "value": "CASTOR OIL DATA SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc782c7-25ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633418549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418549, "uuid": "91b20a2d-b9f6-4859-8879-6385ed22f617", "comment": "Malware payload (Loki)", "value": "c3e9c249becb24a345309463006d9d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418549, "uuid": "4ebfe90d-56e1-482b-ac5c-f0647cd0e02f", "comment": "Malware payload (Loki)", "value": "c0ba0b5b9e253973a58cc6299cdfb49d29e59306390cbb2a9a2a076072ab5933", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418549, "uuid": "3d780e6f-33ec-4365-b7f1-9d6816deba9f", "comment": "Malware payload (Loki)", "value": "c27031797101f3ea23c024461f95637c50055a45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418549, "uuid": "4cca3b7b-5f23-4bef-8f09-30d788fb5c24", "comment": "Malware payload (Loki)", "value": "b17000a51769db0ca271813d9c329733f60d360714f9466d753a90425dbd537d91dd3da23cd5d74fe340bbf0664ebdde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418549, "uuid": "6b44162c-6ab4-4f93-a316-d2db75a960df", "value": "T17A5413596F87A577DAA30DB00B23FB38F3BAE504415724038BB03E7F1AE41955E2568E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418549, "uuid": "e353cc7e-1b04-4014-93e0-0a8aac231fae", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418549, "uuid": "7cedcff1-d511-4319-8415-9bcc992bb646", "value": "6144:F8LxBsjmH3UT+PYc4qggyuB/G8pnML/ZwaV5bScUMGIXo9O6:/jmHkiPYVBRuB/Gqa/Zwa5bScH4c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418549, "uuid": "be6ac1d3-ecd0-471e-8de9-dca4244843e7", "value": 298481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418549, "uuid": "871bdff0-7b0c-4b96-b594-f0dbad0fcba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418549, "uuid": "53172ff9-4391-4dc7-9762-68ff4fbb2bb4", "value": "c3e9c249becb24a345309463006d9d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7f2630-25a5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633415187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415187, "uuid": "20d0c1d0-a141-47ab-ae24-686ae8a30cd8", "comment": "Malware payload (RaccoonStealer)", "value": "11066764e7531146f6e566c637283cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415187, "uuid": "f36bac44-859f-45df-9f6c-5823ae8cfbba", "comment": "Malware payload (RaccoonStealer)", "value": "c2a2a4e169f7807e2db78ded0462e8ab0056235634271522c055f2cd27a76171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415187, "uuid": "f3b13e88-dc2e-44e9-8399-fb7843e350e7", "comment": "Malware payload (RaccoonStealer)", "value": "d9e72f02e81929a58f015a843b4180080e192bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415187, "uuid": "b02f5d7d-4833-4ac7-a69a-ee06150dd97f", "comment": "Malware payload (RaccoonStealer)", "value": "0fbcf729342cf4ce741050ba5ee8a16cdda6347ac9bb9e1ba767728ad8139f32cf62df0c1069f15b108e29b095d2b240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415187, "uuid": "0db97aaf-005d-4639-b85f-8ed6435abf5f", "value": "T167348D10A7A0C034F2BB12B649B693B8A93DBDB06B3495CB67D51BFA46786D0DD30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415187, "uuid": "53a7718c-6e7f-41a6-bc8f-0f55ee9be29d", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415187, "uuid": "af7b207c-82c7-428d-8ff9-0ef3f1224ce1", "value": "6144:zoryXWHeu1zSjFrjB785eet9Mip+H2UAvhF0:zin+QzSZK5eet9J6uvhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415187, "uuid": "90820a3a-a1c8-472e-b30c-6795a0085408", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415187, "uuid": "7f587575-dfb0-4e60-92a7-9cfec9bfa7a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415187, "uuid": "e9db9ce7-4739-4a16-a0a3-139a3889cf4d", "value": "11066764e7531146f6e566c637283cee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7ea640-25ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633418542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418542, "uuid": "9772dc22-e4f8-46dd-9a2f-34c1321a0314", "comment": "Malware payload (Metamorfo)", "value": "33f2dff76951b1704911d3bace5dc1b8", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418542, "uuid": "9c54642e-5cc7-41a1-805e-945ce2da76ef", "comment": "Malware payload (Metamorfo)", "value": "c2b9f355b3d1eb9bd61e54c75d9909bf412028afd6a1719ac2ea3748e086ee64", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418542, "uuid": "eabb1d20-7d57-4216-8f93-0aeee8586b00", "comment": "Malware payload (Metamorfo)", "value": "19f927dfeff1e8038e208760a582352aaae637dd", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633418542, "uuid": "582e34dc-2ce3-4101-8f61-fc4e90310472", "comment": "Malware payload (Metamorfo)", "value": "14911a9067161b1c9ced72add9fc2a7130cc1826991d809bea96d32d56ed114715193d551da0f58e770f88b8d3943767", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418542, "uuid": "f1666631-4098-44ce-86e8-a75346b049ac", "value": "T1EF447D07B3D5437AE4DB07325B8F93628A72EC788663412B1249790E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418542, "uuid": "ca7d8ee3-8f4b-4c0e-b4c3-7e154d1ef8df", "value": "3072:RmMj5J903DaY4Axwgz88ereWn/7w05g0ZMcB3RUN46ILJ9+ZB5yOan7w:RmV3DaY4AM8er1nzTQrUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633418542, "uuid": "81b1b01a-596e-44d7-84a2-6f4c7d96cb8c", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633418542, "uuid": "0f6efc67-e436-4887-9cba-4576c7d47915", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633418542, "uuid": "eaa13407-6ff5-46f5-8c55-8247e69fb365", "value": "33f2dff76951b1704911d3bace5dc1b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7329809-25e7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633443821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443821, "uuid": "e2202baf-fa78-46ec-a208-18f7c7d404cf", "comment": "Malware payload", "value": "7a58dc1c82ff4d6d158bc687e62e313e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443821, "uuid": "351cf7ad-36d6-48d2-b5bd-d77dc7cefcc4", "comment": "Malware payload", "value": "c318d441b4f4719aadc3112660634362cd70574583eeb707106d00d5aa5da784", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443821, "uuid": "02532a3b-0dea-4488-ad31-7fbd95da68af", "comment": "Malware payload", "value": "3aa94a5456633b8fc6e8064cc69795ba4aa5ce9e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443821, "uuid": "21d79a92-7b80-4e5c-9ceb-3c148cf4b432", "comment": "Malware payload", "value": "df42ed88ed094144613a7e2556fa032d98f99eb604049c8a1b0354d6674943d63966a083e80dd87b0b73a70588440175", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443821, "uuid": "8a454140-3807-4fa7-b727-69daf970936a", "value": "T1364533F8EDC19CA1AF3005A0321A659CC93615DAC9A7F9175AF3A7A8DF805CC53443EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443821, "uuid": "4cdc6f3a-770d-415f-81a6-461da4c425d3", "value": "24576:W253n+b0F6dhS0batTe9r030plIlc6AHv4q9gfhQ8rjPW9N7dhjnH:V3+bc6d98TyrhHIqv4qCTmz37H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443821, "uuid": "65770c93-a3ee-4c63-ac4f-2ef3d4250c9c", "value": 1258526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443821, "uuid": "2ada6693-4c68-4510-b1f0-497c6091551d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443821, "uuid": "9d7eb071-53e5-4415-850e-a9dae70c4401", "value": "PO 4500151298.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b284fd4a-25db-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633438606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438606, "uuid": "9f5123f1-1474-4f8f-9c18-177f9313c795", "comment": "Malware payload (RaccoonStealer)", "value": "3051575137e975b09cf1247e2b4443a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438606, "uuid": "7128596d-629f-490b-b104-2b0bcc60e81c", "comment": "Malware payload (RaccoonStealer)", "value": "c359a8c77b2e1242763cde0c9fa0551ed505a4a252bda9f7d91826734f699f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438606, "uuid": "677c32c3-d0ea-4390-9d06-3410f56ba7f3", "comment": "Malware payload (RaccoonStealer)", "value": "1645fc0894a78e987356feb7e390bb169cfd9b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438606, "uuid": "679e5544-6ca8-40a3-8ddf-5f3a80a63b51", "comment": "Malware payload (RaccoonStealer)", "value": "1e6669711a26ec3b8195a43524c7b4e6453894cd7032152867c896178364ed2680e30f7298947001567cedd1ab3f0b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438606, "uuid": "dd492e2a-8904-4371-b6cf-7c645b73137c", "value": "T1B9B4F11076E0C034F2B762F648B593B8B52CFE71AB2896CF56D52AEA16746E0DD30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438606, "uuid": "529717ef-b0e5-4a95-8b76-5eb232cf4c9f", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438606, "uuid": "ef7eef64-65de-44b1-89e7-214a784c21ae", "value": "12288:WIWAZYv0OyotgVm2oQh20UEZCwJR8//cj0:AZ0oAqpXxC832", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633438606, "uuid": "6d5cf0ce-8944-4c08-9479-bf8fde9bed75", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633438606, "uuid": "a693b0a8-10af-44b0-9a96-3894424848d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438606, "uuid": "2226e986-707f-4791-8c1c-211844415fec", "value": "3051575137e975b09cf1247e2b4443a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e38e5f4-25d6-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633436424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436424, "uuid": "deaafebb-6513-4670-b42a-b4de23dde644", "comment": "Malware payload (GuLoader)", "value": "9110901475e2ee5c1e5b2bd33c09475c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436424, "uuid": "a503d2e6-bdad-41bb-a73c-55054d8d826a", "comment": "Malware payload (GuLoader)", "value": "c42de931c0ff1f554d39b2336e9abc0c870d94da8456494c13b7bdecc03b587b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436424, "uuid": "1e008db8-381d-4a89-b98a-c59f05ce23a3", "comment": "Malware payload (GuLoader)", "value": "64c2b79b4cac0e1a89dd4334983704cc40a32c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436424, "uuid": "42f211f4-7196-451e-9b01-c5f9907c4293", "comment": "Malware payload (GuLoader)", "value": "e58192518083bfd0f027dbb6d3c2fe5ba59c41d6c82b2da8d138f77af1672e893b36258dc202443e695e1436e6bf970a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436424, "uuid": "e87142f6-7e51-489b-9407-350814759dea", "value": "T198C33B2379989C64F3B58D338461CA76142DECA23B299A2FB5547B0ECC333D274E165E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436424, "uuid": "8668a81b-00f6-4efd-aeb1-d580c8d49929", "value": "1eb3a7317bca1c3a71a2a06454a2aa39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436424, "uuid": "8459bd7e-2890-4bd1-9cda-f9d18d5f1803", "value": "1536:A6NO80sVcAxwypASZdqpLuF7HEONnOq4/4NA703CjK3oDH7eIr8JEX6RSGdD:A6N9jcUHZdqpyEONO0T3Wrsy6RSGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436424, "uuid": "e0caa206-00d0-4305-a26e-137ed40dd179", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436424, "uuid": "4b504931-6854-47a7-b446-bd17b1ccb99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436424, "uuid": "b54ec7cd-e734-4181-8df9-d223e446c553", "value": "Payment Declined.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f54961d-25f1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633447781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447781, "uuid": "4da9a30b-e316-4d30-aff8-04651c20743f", "comment": "Malware payload", "value": "9b0a45ad4573e67603487b1c5ed22b63", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447781, "uuid": "1429729b-8534-4ffc-9ff2-a16c5d134205", "comment": "Malware payload", "value": "c4e7fed868e9141630c30385943d95b65600972ccf6b2039358a179d40335b8e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447781, "uuid": "24c99454-54f6-41f9-add5-b9ee970c686c", "comment": "Malware payload", "value": "0154810e393b2e4b564decd4738c675483d392ed", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633447781, "uuid": "892922ca-b1c0-48f0-8b97-4f59e5d42cbb", "comment": "Malware payload", "value": "ec033249bc39f3939258c55afa5b2f28d96878e469cdf5d798e0967f9f3d7edff18a12f5643b4903431c1b8baae6dfcf", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447781, "uuid": "489c2fb5-f42a-4576-bf2a-b624540aaeee", "value": "T144833F458347936FA59F1CAFEC47085A23F18D16AAF8418497F658EE2C7E98C94F024F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447781, "uuid": "b807e9a6-6c2d-4777-812c-975a84287603", "value": "1536:TcSoPFh67RiCEmXqdmCsAtXTiiqDmdbXdrEzh9N2NR:kJd7XTPbtrEzENR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633447781, "uuid": "6c732225-d395-4498-9e7b-a7b4789565c9", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633447781, "uuid": "cb9b208e-e21a-458e-9dcf-de9e127720a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633447781, "uuid": "2e7eacd7-8166-4fde-afbc-ec2a2a4a891c", "value": "SysLogin.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bb4865-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633412457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412457, "uuid": "7132bcee-38fb-4e86-ad54-f634291089ef", "comment": "Malware payload (RedLineStealer)", "value": "9d8bcaebbdd2112cb8974c5ac4e022d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412457, "uuid": "986ab09e-4a50-428c-8816-8366c651948d", "comment": "Malware payload (RedLineStealer)", "value": "c569326abd44e1e6d0b0a843c41f39c8b06bd1e0085233bdb4024a2289a811cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412457, "uuid": "1c074c76-a004-4aee-b324-bc31a89af277", "comment": "Malware payload (RedLineStealer)", "value": "a30a4e0e30835f3730bd1ddf350bbbc89c8f9178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412457, "uuid": "2509e182-20ff-4ef4-901e-1005bb09ad32", "comment": "Malware payload (RedLineStealer)", "value": "f34f34692055eb2953695a440404d598c4d5111e74e89277b323f628626339b65861ae3b14f4eca23a33de22367e1d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412457, "uuid": "cc6cf201-714b-4d27-9812-2119d72e33f1", "value": "T16764BF30B7E0C035F5B742F4497993B8B92EBEB19B2490CF52E426E956246E8DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412457, "uuid": "a6001002-1aa3-4bc0-bd69-0738b2df5041", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412457, "uuid": "fa25b1bd-9dad-4c08-9c01-30375e4f2c9a", "value": "6144:io0jJvgP9mjNHuLOt47OzwwcPz4pRQY4sYkBjXOcwBf/cMGFO:ih94P9mjNO8RzwwEMnosJjXlqnHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412457, "uuid": "68c78c1c-9102-4410-82c3-b3c0cbf8b956", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412457, "uuid": "60b64159-15dc-4e9d-8884-9d073468c843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412457, "uuid": "851b5357-bf48-4ca1-bcbc-970e2199b419", "value": "9d8bcaebbdd2112cb8974c5ac4e022d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34dcecd-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633454472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "bc2bf97c-0ee9-42fa-b476-3570ef356385", "comment": "Malware payload (Smoke Loader)", "value": "9f48aa305e591b5106d427be33f048a3", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "e6983e32-42eb-422f-b229-38cd2cb8bcd6", "comment": "Malware payload (Smoke Loader)", "value": "c64d6d97f813bc36de79ab49f2a9ef0f45c14fc43e7e6e7a4b54053b8bc05791", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "cb1a4bf7-18c1-4112-88e7-00f496fb984e", "comment": "Malware payload (Smoke Loader)", "value": "52e93fc5822ebfe6bec03b73aa7e4a5532d50525", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "34363bbc-8d20-47a5-b519-bc55c4753f98", "comment": "Malware payload (Smoke Loader)", "value": "3720464c1001c942f20e0695120a7aa030aa7317c3b45bcc68b2fe71c24851df08a6f18c8233d1c22ceab2026df38880", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "12d9fef2-f132-45cc-bb7c-4c6a0d30cdc2", "value": "T1EC349E1077E0C034F1FB16F948B9A3B8A92DBDB06B3495CB96D52AEA56746E0DD30343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "1d5712aa-7e7a-49e7-a129-410d47e627b4", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "e86e203a-5a8b-426c-a8a9-fe97b679eb8d", "value": "6144:24AwhPQpXSC0OGCDhlw1wv9HjnIbAuMt55:2hiAXSC0OGylw1sjI7O55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454472, "uuid": "00772b51-6a9c-4662-974e-b403fe38a5f2", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454472, "uuid": "6358628b-bef6-4f81-9532-9d3f1776706d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "fe15399c-940f-4734-a0b1-bfe24d46d609", "value": "9f48aa305e591b5106d427be33f048a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641a8059-2624-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633469828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469828, "uuid": "405e7e8d-2078-4b43-8ac7-eeca404a401f", "comment": "Malware payload (RaccoonStealer)", "value": "b081a33077d2ec833d558036b89493d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469828, "uuid": "90899df3-f319-45ec-8cff-7aefcaa09206", "comment": "Malware payload (RaccoonStealer)", "value": "c67646ba071947726cb2420a03887901a79a762844862eeb61f2fa8349ea355f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469828, "uuid": "8b322b2d-3ac9-407a-9d7a-35f335186fa7", "comment": "Malware payload (RaccoonStealer)", "value": "4d4b93cd58cec29c036c021d15eed99a55fd1ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633469828, "uuid": "9d585982-3f80-4189-9fdb-be1ca884e8b7", "comment": "Malware payload (RaccoonStealer)", "value": "1a4f281c775c8cadf555b31db84727cfe6181f9e1326bdb3ae8af502af83ac374e819df22cef0d6e48bf312afb2c0af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469828, "uuid": "7650c183-8522-4715-9679-39cd6e56f28a", "value": "T1A8C4E0307790C034F4F626B845BA9379A9293EA1A77850CF12D52AFE4A346F4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469828, "uuid": "3ac1aabd-7b46-42d7-87da-02507f91d30c", "value": "af44dcafed165daab29f132f710193c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469828, "uuid": "c19217b7-5d63-49a8-9c4b-0bd27c1fc58a", "value": "12288:U4ghQOrJx3PREJ7hE4gZ/qX20wAyekwwxTkZAUz0m7td+a:UDh5ryfaqX20wAavha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633469828, "uuid": "eb3087d3-bf57-497f-b5d4-b7a8e2d96f6c", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633469828, "uuid": "be60b73d-4643-4ae1-a69f-6f0cefec700c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633469828, "uuid": "4a20d95f-0d69-4974-b5f0-942c11e0f8e6", "value": "b081a33077d2ec833d558036b89493d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c4d44c-260c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633459627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459627, "uuid": "21e283da-ab85-47ed-8d20-063ca03ec0b4", "comment": "Malware payload (ArkeiStealer)", "value": "2d6d77d56d45d751d13bf0483a21cf6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459627, "uuid": "d341dc90-28ed-48a0-87b6-fce8e31bd0e4", "comment": "Malware payload (ArkeiStealer)", "value": "c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459627, "uuid": "865e9a4e-50e7-40b5-89e5-801f35fb6928", "comment": "Malware payload (ArkeiStealer)", "value": "6353a9f6b1e32913a1cafd0b53d95006e693a991", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633459627, "uuid": "581d610f-e1c2-4944-9ae1-810f75bc4b6a", "comment": "Malware payload (ArkeiStealer)", "value": "bfec9bfcf8c348318c94072f7cef1750f13f956ace99c49105dfe5ab21729a1543be1ba3e1d24d3aaa19d1e8dafc49ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459627, "uuid": "80e02e51-e7cd-4c99-9a8b-1821e9144557", "value": "T1763512276E271563F01409B14AF051F64F3EAC27B8826E5FEB46F91D0DB2706B8D127A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459627, "uuid": "a2857a79-70a2-4452-b785-4af07da2d51e", "value": "31fdddb41123508749dd6c9468f73e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459627, "uuid": "7a400b94-7ba4-4d71-8ce5-9b40443bd003", "value": "24576:IlE2q8MnAWRpnwU9QtTJaur6Syt4VhkFha1OIgImZk3xk5npFhkF96x5hkFYelc:2EeKTqtN7r7VV0VIm0yRpF0I0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633459627, "uuid": "0a108086-ded9-4ce4-a80c-22d5b6a5d321", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633459627, "uuid": "72066fd4-2549-43f0-98ad-aa174f9d3fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633459627, "uuid": "ef1eca3f-2478-4fa4-9f83-5af0552549d8", "value": "2d6d77d56d45d751d13bf0483a21cf6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16eccf93-259a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633410428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410428, "uuid": "16f49f45-a551-4c39-8bda-e2ed1f5cde4e", "comment": "Malware payload (AgentTesla)", "value": "6d6507ee3044d850e83d93beaed8f4b4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410428, "uuid": "3e1e3fa9-a102-419c-8d2f-da1769f8bf5e", "comment": "Malware payload (AgentTesla)", "value": "c6853e1c783499e92bd1a511e67f71b3df96cef6cb408381af56ba8c166bfcba", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410428, "uuid": "97f999a0-2a40-4244-970f-891f07c2b658", "comment": "Malware payload (AgentTesla)", "value": "efa752cae100b88bf153ee5813446e9484ca5d56", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410428, "uuid": "b1372b0f-8ef1-4ce2-814f-b16fedd42143", "comment": "Malware payload (AgentTesla)", "value": "629bec6c282fac84a17446599067bd41a31255c86262ac2d53ce7cd4dbb1d8f1374de41f8bd3cd3b3bd250a23096bde6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410428, "uuid": "d7a7394d-afff-4cbc-8ff4-daf91cadcd25", "value": "T19BD42371A2582496D08FD63B174A363D398BF3CCAA71A70307B4A3D613F0BE55A95DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410428, "uuid": "cf0667e1-5023-4956-a53c-c58e66b2be75", "value": "12288:M39ZBN7qJ5M561MG/uLFk32EYqrLv1cUHejBTOnSZACM:6PBNM5l7/uLOm4yUSSSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410428, "uuid": "0c8b1583-d458-4fd4-a9bc-4e14e586e6dc", "value": 634972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410428, "uuid": "7cfa75c0-f621-475e-a22c-e0055a6ea87c", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410428, "uuid": "9357ce16-3687-4a3b-899c-a821ef4a25ab", "value": "checklist.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea4b12b-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412132, "uuid": "8a836873-7993-40f6-b11e-d373b5520a58", "comment": "Malware payload (Gafgyt)", "value": "32652ba756f084eaeb689d0a56124e73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412132, "uuid": "8a344743-cc91-4741-8a59-644f446d97d8", "comment": "Malware payload (Gafgyt)", "value": "c692c2970a743e92bfde6ada56bb80e9da261dcdb633c1f221fd37a7f8a55d82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412132, "uuid": "edbb2fe5-70cf-4c2d-9cf3-fc1a05f4f08c", "comment": "Malware payload (Gafgyt)", "value": "60599bd34638361f3f93c8042c3c2aa5b146fe31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412132, "uuid": "ac1638df-1a90-4bc1-8f1a-74e1c0124b02", "comment": "Malware payload (Gafgyt)", "value": "7a4f2dc2c9b95c06db5aa31bc42bdfda224efaec71e116102ae907c63ce896b82c357e7e405baa67818393f617f77600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412132, "uuid": "a71cdb34-2bf2-4a62-a786-e81460f8222d", "value": "T15B930893F801DFB6F40EEA7604E347217670BB624E532662731B39A6AE761D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412132, "uuid": "090a6f54-6b91-43b8-8aee-fe19167e2aeb", "value": "1536:EVAsj3kA8eXllsG+EKQmCCecrIy9ctUaFfCOayTOg04pp3jpTmQ0VqXjetR/7Q:r8kEXl/+FTu7tUaFfCOayTOt4hmQ0Vqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412132, "uuid": "52750ceb-dd7a-494a-a690-845e03e072ee", "value": 94359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412132, "uuid": "e26bc6ea-051c-4f21-8b0a-47a9fa4bb45d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412132, "uuid": "77795e83-d3e5-45f7-833c-8368da110214", "value": "32652ba756f084eaeb689d0a56124e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07dca81-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437314, "uuid": "28403a04-afc4-4291-8a2d-c606313b30a9", "comment": "Malware payload (AgentTesla)", "value": "bc80a705d1b3d1821740ac69af3c5a4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437314, "uuid": "c85201b0-355b-463d-89f3-5a9d57b44f3f", "comment": "Malware payload (AgentTesla)", "value": "c6d7373ca5157896536c59dd3582031d974ec4b8daa03ccc15f300e2bef21fed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437314, "uuid": "d8d1ac8c-84dc-4e6b-89e2-54d63277fd2b", "comment": "Malware payload (AgentTesla)", "value": "457ac334b676c5e2c87d53f0c8b7a23382e0e875", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437314, "uuid": "d4566b4b-87d1-4859-a7a5-f73c1f76e879", "comment": "Malware payload (AgentTesla)", "value": "bef88d27b66d6d5d1e5c1e1df7052f9841e716bccc9f64caeb684937d4df87e29c3483e2a764b10287de55b1ed0e7ab2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437314, "uuid": "4da47048-8158-4389-8b81-d0efe7330cba", "value": "T1F574222679250F22F7E7A23E798CB1DE68E9BC587FD84577F3A9B434353C28A4402614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437314, "uuid": "7e8d655f-5be9-4158-b180-b969f442df88", "value": "6144:tAfX+R8Xnm07giYJpr3m+m9qyYHY1tB4fZ4MGnfHmb51FNm6:byNgiYJN3m3YZyv4fZ4bnfHmb51F46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437314, "uuid": "fd73beb3-12ea-41e8-89a8-a41fc63806db", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437314, "uuid": "ab585287-c189-41e6-9ba5-547a9592a1f9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437314, "uuid": "3b096cc2-4aa4-4931-9083-48bb9f395514", "value": "Swift Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143cdd62-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633416866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416866, "uuid": "961fecf6-3580-4cca-9c4f-5a2e26033820", "comment": "Malware payload (Loki)", "value": "1cd70a26399e945321ff94479abe9491", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416866, "uuid": "607c8952-2bb5-4c7d-a63a-3ea58ffea8da", "comment": "Malware payload (Loki)", "value": "c7599592925bcb8d8b4830fabac1e0f83a594274df31523f88ff03e480458521", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416866, "uuid": "124760cd-bd53-46f7-9d68-0504c56da4d3", "comment": "Malware payload (Loki)", "value": "b8b3e257e207d98e86388fe552180f71f84657fa", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416866, "uuid": "8d41866b-5496-429c-a6cc-504d74ee7903", "comment": "Malware payload (Loki)", "value": "7249312369517bf33354f56c1702f797d8e8af496cb61f81cdfa08680e6e4ba24b7c6c018f34ce44c901f64bc33f3220", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416866, "uuid": "ffed3141-42fc-4d3f-8f48-675fb9cf1cd9", "value": "T1B564227A7682BB66FACF417961AF5A350598CD7F2B8EF208D42C331CC4792E4353A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416866, "uuid": "b89e88ca-e7e7-425e-ab87-cf12868874a6", "value": "6144:TutWm1lJ0UisHFx6Di0ekX2AhETuWX0cqIGXtR75FrJgM6kuLA8YWJPjR:Tut7zDZFx6+B8m0cqIGXtR7bJgM6k0As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416866, "uuid": "db6ea6b9-f73b-4ae6-b314-9961654c3ac0", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416866, "uuid": "30876988-60cb-4d86-8980-679de541dd91", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416866, "uuid": "09c682c5-ea8d-466d-9720-7fdb689852b3", "value": "_POrder_Confirmation_.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12986adf-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633412138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412138, "uuid": "32d3e2f0-63bb-4cc6-9bed-a55e6fdc951a", "comment": "Malware payload (Gafgyt)", "value": "ba9be9fe34c00a390811576a6f573a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412138, "uuid": "5fd113fc-af6e-4b9c-847b-41f7ae220d3f", "comment": "Malware payload (Gafgyt)", "value": "c7a62274e983fb78fb91a316d34162fa64b08017a45a4fd7a97462d55642817e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412138, "uuid": "7def9e34-d9b7-4239-9b5b-ca9863b4adc7", "comment": "Malware payload (Gafgyt)", "value": "60e47e612ec009135cf10f416af76bdef897423c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412138, "uuid": "591a7d30-8b95-43b6-a3e6-ffb2ee809e17", "comment": "Malware payload (Gafgyt)", "value": "1292d74e765195b12e23b005e4d0455de5afc891bf34a4c0996e56522ae4b4d3f784389c3c5aaaea94d1c5831c7d8f2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412138, "uuid": "3e110cc2-8ce2-45ba-83f0-71b203a532f8", "value": "T13DB3C617AB61CEB7C81EDE7306AA4501208DE05642E97B6FB3B4DA5CE74B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412138, "uuid": "c9f486d0-1692-4d86-8775-655d8be18fa5", "value": "3072:sSinHZfD1UaaOwNoEgb3yUmkixFxfKcgjQ:sSorCaaOLEgbCUmkixFxfKcgjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412138, "uuid": "15a29ac6-3574-4bf4-9887-5f41bc946795", "value": 117457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412138, "uuid": "da3a992f-0896-45e9-b804-bb431b93f696", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412138, "uuid": "961f8084-de70-4fe3-95c3-c44daf5347ea", "value": "ba9be9fe34c00a390811576a6f573a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e361382-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633417097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417097, "uuid": "276290be-f0d8-4ab3-99fc-57b88ece67d4", "comment": "Malware payload", "value": "95c2f3c63cc7b18f63c13a55b0c354ed", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417097, "uuid": "5580da4b-795f-4124-98fc-49476657ce4f", "comment": "Malware payload", "value": "c93d48452f18ce061b6aa4b659b6a86ab7368621e4a17e2d5405b61c91155dc9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417097, "uuid": "7200dc10-8873-41ed-8ada-39988eac5faa", "comment": "Malware payload", "value": "cb10c18f69d4d7acb8e3804c4fbac63102de8779", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417097, "uuid": "8f403a06-21d1-49b2-9eed-c8137a66ca69", "comment": "Malware payload", "value": "b1c971425e462a019243ac60ad1ed2255e7654404deeedb084f5e975f21d1bca049688bc20cb6efe7143b93520a23e0d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417097, "uuid": "efec1f41-565e-4724-9bad-c71ef9644b5c", "value": "T126B58E22B2D18437D0776E3CCD6B6399942A7D602E38884F7BE41D4C5F397817A292DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417097, "uuid": "e65551ad-1300-45ff-8b8d-655d0ca58806", "value": "49152:zhhrSMZ4TuLP8ntO8dlVpSTPrVdyOYyEA:zrhKTWPY62OYVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417097, "uuid": "98cb4be3-6092-4857-91ad-0815477eaaf5", "value": 2374144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417097, "uuid": "58c76a79-ecba-4262-a137-a76742553b47", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417097, "uuid": "4111bfbb-ea1a-421a-a6b2-aeff6cda1ee8", "value": "4TES wodncdqcnatdjizeiunbszewuumjv.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e33b975-25cb-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633431646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431646, "uuid": "dd5d2665-94d2-4d50-be79-1ac4f3b1f5fb", "comment": "Malware payload (GuLoader)", "value": "91b57d135d1dbb0e764c1af844ab917c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431646, "uuid": "42f8c902-2e89-43db-ac88-605e6b248159", "comment": "Malware payload (GuLoader)", "value": "c9fe735dbd804a53e0c6f8a966d51bd184d05331837338951c2d0ae7b0f9368d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431646, "uuid": "6c6c35bb-d9c8-4488-bbe3-97caa0d73424", "comment": "Malware payload (GuLoader)", "value": "6385452918edd8b95743df105691d42bc2d7ae2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633431646, "uuid": "20758609-f655-4cd8-a21f-4f4ee112bd90", "comment": "Malware payload (GuLoader)", "value": "74cf8829c8174d2a49d853fc8126f74c2ff91eb36ce79d00eb4c86cc0a69fbad35127e055c8fcb1a8790d2082d3d12ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431646, "uuid": "b26f7274-c294-4ce9-803e-21c43594a26d", "value": "T134A3D272E5A0CBE5E954E6FEBB31F0B600F1AD22C8920D0B76443F0AB4F65C669F1615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431646, "uuid": "9f8ceebf-281d-43a9-b543-3be512f22e6f", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431646, "uuid": "7f0b0adc-c174-4605-ba60-a29761b7677c", "value": "1536:tZgWb3TbLYjQUhQSb1WvO3OmHtnhXs0Mmy5Y+krQ:tn3TbLmMSbOf+thJMj5hkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633431646, "uuid": "7f52eab0-8138-4f9f-8c53-56531b463a65", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633431646, "uuid": "c91aef7c-2a50-4ac7-9ddf-0df9e3449561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633431646, "uuid": "4b081843-28a5-4877-adf4-67aea1e8ea5c", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d0c043-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633437321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437321, "uuid": "66748387-6176-4f60-be9d-849201baf688", "comment": "Malware payload (NanoCore)", "value": "d77f00df2b7eb688116d54b2069201b4", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437321, "uuid": "0ac4e76e-a0c0-4ab4-b94f-eb9abac9ec3c", "comment": "Malware payload (NanoCore)", "value": "c9ff1a872a38e41598adff4d264706041b5d2ddda74ae6b2f79cadecde755ad5", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437321, "uuid": "756ec51b-4412-4bcf-a6dd-9bfb113d5d44", "comment": "Malware payload (NanoCore)", "value": "ea5f8497c1f619a1f400aa5ef9d7a3fc401ca85a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437321, "uuid": "65dd8ee2-4b59-4ece-9808-26038f788868", "comment": "Malware payload (NanoCore)", "value": "fe71a903c966ee82259f484476257ed0d763c3c4f8b795a4f97438b7acd2032cd0a75f4f5998c985b307233394669e4d", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437321, "uuid": "ee4aa524-910c-420b-a76a-5ad46463907b", "value": "T19564133EFFE2A9A1D0676A34479C120E553FEED813F8DAD9708D310C74746AA26161BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437321, "uuid": "2b58a022-5d78-49db-94ee-4746664d858a", "value": "6144:2QQQQQQQQQQQQQQQQQQQQQQQQQQoQQQQQQQQQQQQQQQQQQQQQQQQQQZKQQQQQQQB:2QQQQQQQQQQQQQQQQQQQQQQQQQQoQQQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437321, "uuid": "90b93f7b-340a-437a-ba66-0740fda627f2", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437321, "uuid": "2065d10a-4f9d-440f-90ff-1e1173bb8f71", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437321, "uuid": "2a887898-2017-477c-b84a-34b45a0f47a2", "value": "SB883681QI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40925020-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633416940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416940, "uuid": "6a5b5cc3-872d-4e3e-b24b-f2a0d90b431a", "comment": "Malware payload (Formbook)", "value": "33d3762a74a956ff341f02c2355f8fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416940, "uuid": "96d5607b-080e-4afd-9812-633d3f3c53ef", "comment": "Malware payload (Formbook)", "value": "ca068f5712b190934cbe787dc667690b4506bae94d8d208638d1cadb243d3cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416940, "uuid": "05f2aa89-df62-4cf8-950c-cb171c05299a", "comment": "Malware payload (Formbook)", "value": "8333007912f86bdb3e968ab754e702d3f51bcaea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416940, "uuid": "b961835c-2d34-4e2d-8ed6-b0ceb48ee1e0", "comment": "Malware payload (Formbook)", "value": "d4c290d24ed4dacc49fc633045993b6bbff0bcb3f23d490b970c4b9a74b2fb15ead4977f94a48d61844d2e5dda28e049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416940, "uuid": "773bac1a-89e5-4090-b213-1e410d856e4a", "value": "T14AB46CEC761375DFCD27C1B699686C60EA2074BA530F8223902751ADAD1CAA7DF640F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416940, "uuid": "d4985b09-1425-4dd5-9218-6735d6033535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416940, "uuid": "735e88f0-9b09-4d40-9753-2f9598ddfec0", "value": "12288:F4pQZxBxrh5L78KozGiN4t0H3wDiJ6NwGqv2PGV8iK1ZjyAo0q:F/vLz84uADiwbhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416940, "uuid": "c53b8152-7f5a-47ab-9c81-328edc09b70d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416940, "uuid": "45b2686d-ce47-4aae-b454-978d73df3f55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416940, "uuid": "64d980f6-4bef-432a-9e61-d46bbbc96cff", "value": "04884944334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ece049-25a1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633413788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413788, "uuid": "80edca43-2533-470b-a12e-20c520cf1719", "comment": "Malware payload (AgentTesla)", "value": "bf1682077971f9221d372bc9ee0ba021", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413788, "uuid": "3d75e181-8788-44ba-b9ee-ee8b2bbe418b", "comment": "Malware payload (AgentTesla)", "value": "cb15c498e6067588d19359544e0c2c8cf054ddf2f7b857c180c34425304f87ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413788, "uuid": "2516ef90-4a19-4a44-accd-093bfbe51644", "comment": "Malware payload (AgentTesla)", "value": "84f5b744e37d33b47f72f517608f884a89ae634d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413788, "uuid": "8cc968e3-943e-447a-b71a-a436e0658bf9", "comment": "Malware payload (AgentTesla)", "value": "e924aaebcb93268e97e8abd5ceeef88b935f34b16429f287d05e3d0fcde06f02899255c6eccbc431d054c7f4025bf4f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413788, "uuid": "a61a8cd0-1b73-4359-8f78-f6c0a0b44559", "value": "T156C4F13CC7234715DDB88BFB392C929153B6A4A4968BE3BC2DC4A4F83D637B5A45050B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413788, "uuid": "67d67fff-876c-4bb1-a429-c9c5aa7e532b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413788, "uuid": "b0347d51-46b3-46fd-80bd-9eb699aa4e9b", "value": "12288:D/IoWliu0EKI5HgKtBXrTODNlK4wACy9NDN8w:zI9iu0dI5Hh/XGNlrwACip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413788, "uuid": "14a7e0ba-1fdf-4ef1-9825-65b899cb034f", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413788, "uuid": "a0bfeea8-0e6f-43a7-b1fc-d23dbdba1549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413788, "uuid": "fc817421-8a15-4585-aa6b-0b8ff7064852", "value": "p3U9HgW9Xq50wDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b30bd1-25b0-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633420000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420000, "uuid": "7183a5cf-b371-43ee-a6ae-2a0704a5e1d2", "comment": "Malware payload (STRRAT)", "value": "ef41f3d4f25f9013839f6498089c43b0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420000, "uuid": "1c848337-12d1-4c66-8112-9f66a45a6e0b", "comment": "Malware payload (STRRAT)", "value": "cc10c4878f464167ae729dc5d788abc00f362ce91f64d12aa4e0981e109e7c48", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420000, "uuid": "5fb37975-ed0f-4f99-9a3b-3ceba40477bb", "comment": "Malware payload (STRRAT)", "value": "1f6716a8b5d203f81ecbbc9466dd29fee0ae055d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633420000, "uuid": "e9884446-bdde-440e-abab-03abd50037bc", "comment": "Malware payload (STRRAT)", "value": "63eaadc3c06f21213682e10f453036da93fa55c1d58afca313a153b45a6af0f9100c0bd14a4868995cfa965ec8f32ecd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420000, "uuid": "19fedcc8-92b3-4b0b-9cdf-50685cbaf7c5", "value": "T11B04015FBD8BC1E5F0AB4972C1679E33D61C619AC116556FA3FC68060CB9C6C4A03ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420000, "uuid": "7701167c-f061-4793-a7cb-1be92c19d280", "value": "3072:UfI+iyRXqhHVXzaNzCNWgzLhUfH5R3l+oyHYO6ArDzCXsNAQ9T7dlHvU:kI+HR6h1jNWgHIHjl+pXzd9/dlHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633420000, "uuid": "ce5c595c-9dcf-4c86-bd48-370b164af4d7", "value": 188623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633420000, "uuid": "b204e80b-d767-435e-a7c1-de2ba1332f20", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633420000, "uuid": "fdbcd0be-5965-4a57-9be7-364078b2dcb4", "value": "INQ7654323.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cc35c6-25fd-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633453052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453052, "uuid": "77dcd50c-b249-42e0-b323-a0d86e472a81", "comment": "Malware payload (NetWire)", "value": "e3579b9b1dd8e6e80a5380f044c58275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453052, "uuid": "c9d949eb-9177-47d1-8cfc-f95d91f5f19d", "comment": "Malware payload (NetWire)", "value": "ce0791b1ccec1c7907e99e48f2207cafa0cd2c8528a5e0f6625187b51a14f284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453052, "uuid": "7686dba5-ccf6-4481-8f80-f56a82e26f8c", "comment": "Malware payload (NetWire)", "value": "c848ac1c0ff62485be46d2e3994d909328a93a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453052, "uuid": "809c241d-c4a9-44e3-886c-6a8dc7489cf4", "comment": "Malware payload (NetWire)", "value": "5895e85a19fe886d72c59fbfd9b0589b2fbdda15c85d04d626c4156404da4b76c4ef6f424dd788b709952543d88405c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453052, "uuid": "c892ebac-a38a-409f-b57a-5053cd2998d8", "value": "T105E429429A148FD9F1AEC37861A66110C7F4FF66D320CE2C7D9DB1DA1975AC182ECD22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453052, "uuid": "81e07ad4-fc23-4f17-a9db-343bb7c6425c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453052, "uuid": "e847354a-91ca-42e4-a2b2-572507d254c7", "value": "12288:ypKKKKKKKXKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKx:L1b/F4v4uNNVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633453052, "uuid": "0fe87bd8-fd26-46d9-b3b3-8724668f9d61", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633453052, "uuid": "71318af4-d810-4d4f-92a7-540f7d184dff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453052, "uuid": "ec102c37-54cc-4883-bbbd-99e1b461458d", "value": "E3579B9B1DD8E6E80A5380F044C58275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be550a9-25a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633413979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413979, "uuid": "40e06912-46ba-4f5e-96eb-a7c63ea9a2b4", "comment": "Malware payload (RaccoonStealer)", "value": "4377e5406c2b44a18b89cb672e275ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413979, "uuid": "c3a9d1e1-e3cd-4b94-9c44-e13e2204e2e7", "comment": "Malware payload (RaccoonStealer)", "value": "ceff1483439198cfe5050e486feabcdd9f1f8fa3aac325a11e66163f2839ea21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413979, "uuid": "b3be5d85-9fbe-4833-861d-26bcb51eadcd", "comment": "Malware payload (RaccoonStealer)", "value": "40a8059bc1270f8d85977cfc93f15dbde7231765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413979, "uuid": "ef91294d-c4a4-4690-aff7-3eefa9ccc447", "comment": "Malware payload (RaccoonStealer)", "value": "65ed865b093d43eeaaf92a45e99ff03426b50164558adc95c1d0a7da71c9c9e84d7444d7943e2e1eefa72cbfd378afe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413979, "uuid": "2f33db01-3939-4416-9d4f-85db9de3f6c3", "value": "T167B4E110A3E0C034F1B712FA09BA93B9A53D7DB16B34D1CB17D61AEA56786E0AD31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413979, "uuid": "ad7212df-479b-4440-ada6-aebc12831f05", "value": "98e53b2cb31fce4d393c9de9e623875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413979, "uuid": "b5b4784a-88f7-43a6-aca2-07fd3785351a", "value": "12288:HGk+iTpYx5FGcCDQmyI8KYqVAdc4Fu+hzamz/y4GWjzNdwKb:b9tYx5zzmyI8NGsc4thz5hGUAKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413979, "uuid": "e2b70626-38d1-4d4f-9192-2db1ec70eed6", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413979, "uuid": "0c1f3a5d-457c-4e13-a61a-2bf48cd78a27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413979, "uuid": "3c24ba7c-1688-4a56-ae7b-7f96f6a92779", "value": "4377e5406c2b44a18b89cb672e275ea4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba3aa0c-25d5-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633435964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435964, "uuid": "d2dc1b09-5ca2-498c-a511-2c70a7901818", "comment": "Malware payload (NanoCore)", "value": "d3021247a8a05c5c8048816c8573e80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435964, "uuid": "a0867f73-30fa-49da-a7d8-ca579eadc910", "comment": "Malware payload (NanoCore)", "value": "cf47ae1f9e6aff8d73098258d311bab64c6e0fe919de99bff121a05d9239763d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435964, "uuid": "bd51ad46-3e12-438c-9377-15aae72ce544", "comment": "Malware payload (NanoCore)", "value": "7975135be566dc23f7ef7a7c4e11bbe5c0db31cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435964, "uuid": "2f26a0d5-78b2-4e2c-ba6d-a04441173fb5", "comment": "Malware payload (NanoCore)", "value": "8ab11a28fb619524ba5f49024d53a78429e35af28d17b702e41929a8ca5e5825d9346fcac56b1cf3793d294b48e0129a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435964, "uuid": "3114f22f-e727-42e3-8c2c-67375f1c404a", "value": "T125F4D0566D324009FCDE4EB19A6A56D31BD2DE672A52422BD3153F1AC13A34CFCCA2F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435964, "uuid": "8cebd586-c7ee-44f7-91ad-d753e98e7df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435964, "uuid": "4bda5abf-d5c2-4b72-a81c-80a7f378f226", "value": "12288:/GMSDjEmKXt9tbWwH5iM5tHtF1RkHY5DgXOWrobqyOv:/GHnvStfEwNF1Rk45DUOWMbqyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633435964, "uuid": "891e3d81-a047-49b0-8276-62a02ba66b5b", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633435964, "uuid": "056b7c37-55a9-48f1-bc2e-052926f68c38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435964, "uuid": "97a5f637-70b2-400a-9811-1bd2a6297c78", "value": "MERMAID SUBSEA - purchase order RX86404382953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b34724-25aa-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633417568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417568, "uuid": "0e0686c4-6576-4bbf-ba2e-88eed651b7d3", "comment": "Malware payload (RaccoonStealer)", "value": "ac903847a2567650ce41dc3e3dfb92c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417568, "uuid": "a381ced6-c702-41a3-b86f-b5263c044331", "comment": "Malware payload (RaccoonStealer)", "value": "d012e369ec880e456407a045ca3fe9b207483107bf2996211d602469afc3d8e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417568, "uuid": "ee1f4e04-c87c-4bca-afd1-320d3ca6806a", "comment": "Malware payload (RaccoonStealer)", "value": "0a48d3300b987a7ded87cc753772d6a48a9c7b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417568, "uuid": "b018f0d5-bfa8-4847-a45d-22bd3c55943d", "comment": "Malware payload (RaccoonStealer)", "value": "868227fdfbe4952f10b490b950d72cc20003993128fd38c8df70651be49d5cb5a701f120d013d5a9a1b7e22fbf224888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417568, "uuid": "4f2a97c9-87bf-4dc8-8a1a-f0bf10bb596f", "value": "T159B4E030B7E0C035F5B652B449B99378A93D7EB29B34A0CF52D526EA42346E8DD31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417568, "uuid": "7ef1ab6e-b6a6-4ff9-beed-10cfe48b6021", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417568, "uuid": "2d4ce520-6f1a-48aa-8694-42b541288efb", "value": "12288:xrg4Hr1kjbNldYv+0wojcJKIfdSxzWiFv4LbgdREtFP:ehbNPA5wojwZdSwQ4Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417568, "uuid": "ac40922b-9e40-4825-a49b-b7a20b4d6aa0", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417568, "uuid": "02cb3de7-2152-4159-b914-8783646fd2e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417568, "uuid": "ad9220cb-f373-48c7-a0d3-a7684c692334", "value": "ac903847a2567650ce41dc3e3dfb92c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d48d18-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633454258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454258, "uuid": "5b6b80b7-23ba-4240-8c7a-b8c6d461ff0c", "comment": "Malware payload (ArkeiStealer)", "value": "ad20abb62ada8da1cdfca28b8a1ae481", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454258, "uuid": "49d6dc84-fc46-480a-aedd-d672fc3e43b5", "comment": "Malware payload (ArkeiStealer)", "value": "d025453a3fb7fff337bbe1d3d0b496db587c9aa57ef774a63e6c5b63b385d323", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454258, "uuid": "ab71161a-58d6-4634-a177-9c3254d672ee", "comment": "Malware payload (ArkeiStealer)", "value": "32f3dfe37cb80ef386607b1916c927bed343e9c2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454258, "uuid": "8634924a-47ad-40ca-b7f6-42e2a04c311b", "comment": "Malware payload (ArkeiStealer)", "value": "e3c1791925e4841110900fe53e46fadc53658ab46fe3433f05a73c47410bb3be8b3edf6f2db79dba7c3b231764b78f4a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454258, "uuid": "a17148df-ef8e-4bab-aa6b-65de742eb4f4", "value": "T137E40111B7E0C035F5B712F948B9D3B8A9397DB06B2851CB23C526EA8A647E0ED70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454258, "uuid": "5c0f4ab0-214c-44a6-8a98-445984f587b0", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454258, "uuid": "8ab4ce53-e3e2-435d-ab57-33abc9dbc0ba", "value": "12288:kMX/6h6NDWcuDtC8VCOUgeY/9eT1ChQaU/NGCxpbtWxiBK/bIRa6dP:96hUWHtC8AOr9eT1ChQaUF7xdkiBQbwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454258, "uuid": "2356ed93-07d5-403b-9642-81692e653003", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454258, "uuid": "f607c51b-7e5d-4f2a-a36e-e4594ec44f5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454258, "uuid": "d56ace55-2c9e-4629-a9c7-8da5519f107b", "value": "ad20abb62ada8da1cdfca28b8a1ae481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2745674e-2607-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633457270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457270, "uuid": "bc0c0bb1-66e7-4fc2-b11b-4b5ed0928c24", "comment": "Malware payload (RedLineStealer)", "value": "a075765231dae11ddfc1382bbe4e5ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457270, "uuid": "5538fac6-f671-4f4e-8900-836eb285fe21", "comment": "Malware payload (RedLineStealer)", "value": "d183e9e83ebe8b007903366768884e5ddfd40136f2cd436575e9f251a0f92b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457270, "uuid": "a55a0da7-7dbc-407b-8fa6-775af540791b", "comment": "Malware payload (RedLineStealer)", "value": "5fd56ec4df8beee535c38c6b5d06531a8fbc0519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633457270, "uuid": "86edb9d9-86d8-46cd-840b-9916dcacbea8", "comment": "Malware payload (RedLineStealer)", "value": "f533bc9605a8c82053efd9c51ce8de1ede6a5fbd9e8a257542c8346879c154edc311caef3123d54c9a12ac467a278a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457270, "uuid": "df3bcd17-c1d9-402e-9a9d-7a2b8122bc77", "value": "T19894242864BFC05994E3EEA12DDCA8FBD99A55E3640C743301B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457270, "uuid": "73515b6e-72b6-4715-8711-e8bdeb599eb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457270, "uuid": "e2ce7c08-67a6-45ae-815c-652b33954774", "value": "12288:khhlDEB+iEEvpbDC7daTwclnDSzwzVGyO22La1N:+lUSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633457270, "uuid": "fd08b8f7-a3ad-4121-a5e4-0720dfd9ab14", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633457270, "uuid": "7bdc2861-bc68-4815-8f7b-7a7ed045f1aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633457270, "uuid": "4d682a69-e5b2-40c3-8081-f7ae1f1abee4", "value": "d183e9e83ebe8b007903366768884e5ddfd40136f2cd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a17c93-25e4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633442173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442173, "uuid": "36757613-4abb-463a-af31-3f0b821e3ec8", "comment": "Malware payload (RedLineStealer)", "value": "dcb58f4f12e3945fbaadff7655a8f613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442173, "uuid": "ca2a7b6d-3fcf-42a3-8961-c6af079aaba1", "comment": "Malware payload (RedLineStealer)", "value": "d44d77232a9e6e684f1ece4c9c05b3dcb63d4296cfd29b0951b0100caedfb0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442173, "uuid": "2912d325-aee4-4ae4-922f-143c277b0bbd", "comment": "Malware payload (RedLineStealer)", "value": "6bf5da0d2e6402e02791da994f814291849308a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633442173, "uuid": "b1740575-5cfc-466e-8ade-f090dd3aef1d", "comment": "Malware payload (RedLineStealer)", "value": "fac6783c3bdc405b3bdb7164c5267e127eb1da6b0de25e4bd6cbadb1d8d639ef1ce63bd8944eaa5b15f419420c9490da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442173, "uuid": "8c069a89-5ced-47f8-8676-1902cccb7ae9", "value": "T138C533417FE684FFD696153069843FB4F4B9C39C072458CB3798970A8F398D2911AEBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442173, "uuid": "70ad71a3-325f-4811-9fad-2071afb47d90", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442173, "uuid": "5ac08e11-a265-4c84-a3f8-f26c88cca436", "value": "49152:xcB6PkZVi7iKiF8cUvFyPjvzCxtghRt12QWGoVZoBjz/o0MeJEwJ84vLRaBtIl90:xkri7ixZUvFyPftRbGhXB0NmCvLUBsKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633442173, "uuid": "18f23f79-2750-4948-ae1d-1fd891de4744", "value": 2664525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633442173, "uuid": "6a2d93c1-3471-4737-8a0d-38b84eb3c464", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633442173, "uuid": "dcf7b311-d1a0-4551-8418-c46084f174ad", "value": "D44D77232A9E6E684F1ECE4C9C05B3DCB63D4296CFD29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b36f113-25ab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633417924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417924, "uuid": "61c6c5f1-f24e-4747-8032-63b0583b122e", "comment": "Malware payload (AgentTesla)", "value": "ed69709ed965f3d15998db0ecb60ad4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417924, "uuid": "78d70cfb-834c-4e9a-953f-ace8670c070a", "comment": "Malware payload (AgentTesla)", "value": "d47bb2d6f7ec69ba6475aea16be4550f676dcc802088092f0d32daf42de501b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417924, "uuid": "4ca45c1f-6693-4cf8-8aac-7636659d6a0c", "comment": "Malware payload (AgentTesla)", "value": "12c9ef4d9408ee4d243a650bf178441fdac9dfbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417924, "uuid": "8e5bcbfe-700e-42a3-a6fe-d30c0fd5d2a2", "comment": "Malware payload (AgentTesla)", "value": "6eae2f21c5df67c831f031d922d4cfb5821d24d62945e896156dcc0ed1e73919b79895c70602a476e17dd9bc577c472f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417924, "uuid": "637c0b2f-1dfc-490d-acf8-c662f870d287", "value": "T1F8D4F13CD7634B05CE398BF33918A6A047B29198968EF7BC1DC4E4ED3E63775A45090A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417924, "uuid": "7238c7ae-2d32-4a8b-b898-7ff2447b389a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417924, "uuid": "550dd960-c644-4c1e-bfed-1371ba773bdf", "value": "12288:XZtqIoztFU5iiiLzgkTcOKn2ac5/kFwSTy9NDN8w:JtqIQLUI1g2ydqEip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417924, "uuid": "34127678-73c4-4151-905e-3addc3b3685d", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417924, "uuid": "ed10ed45-ad62-4a5a-a4ef-b5b287cf465d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417924, "uuid": "f354b2dc-8262-45b2-93a2-48d127144fc4", "value": "INVOICE PAYMENT PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018212c9-25fd-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633452912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452912, "uuid": "7f5f2b01-6aed-4984-9704-1755de485d00", "comment": "Malware payload (TrickBot)", "value": "7cdbcf8253a45f476d2a8d1dbf7bac37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452912, "uuid": "25eae00e-8b4e-4155-a664-b1d35372da75", "comment": "Malware payload (TrickBot)", "value": "d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452912, "uuid": "b7722400-e51f-40b8-b6a2-83519933bed7", "comment": "Malware payload (TrickBot)", "value": "e23a3d3a7ce75f2ff9d1af7591e770042ef7f0db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452912, "uuid": "252a641f-8adc-4a32-b100-0f7ef49b9ed5", "comment": "Malware payload (TrickBot)", "value": "25b798518598d2c4e6bc3e51213f4e0c7a98170e62ce142af420f873fa874b2834eb46b9b77ef5b8831c5168d0cf43fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452912, "uuid": "d8928b3e-49b9-41cd-817d-8c978e3359d7", "value": "T1FAA4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452912, "uuid": "5fe2bab8-3671-4f5d-a383-1f92e597090b", "value": "f34a0f23e05f2c2a829565c932b87430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452912, "uuid": "29cd622d-4188-4253-969f-127ddd7d6464", "value": "12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Klld:bEKNb/aZl6KdSrs+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452912, "uuid": "4fcab753-4a67-41bf-95de-c3a54a799f54", "value": 487551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452912, "uuid": "90f74d59-7fa8-4293-a350-be3ff603c6c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452912, "uuid": "182731a3-aa80-45c3-a792-a703f79a3481", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa704097-2599-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633410380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410380, "uuid": "0f75fb7c-60dd-4b41-bfc5-4ce310f2b278", "comment": "Malware payload (NetWire)", "value": "a1e3bc029cfb7e72f553833057e242f5", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410380, "uuid": "27c17c6f-989a-4609-9a35-ee09d872f41a", "comment": "Malware payload (NetWire)", "value": "d5a60b271318f87d0c04e707b465dcac2b45deca18094eb0088b880080900e4e", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410380, "uuid": "f979d8bd-e630-4dc7-bded-3c698b9c37a3", "comment": "Malware payload (NetWire)", "value": "51c1cf6eb9974bdee2b5e5de23c1f24557625b23", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410380, "uuid": "ba309eea-da33-4649-a4d7-40b578fe2e30", "comment": "Malware payload (NetWire)", "value": "92c1c247c583dd3a062baf5294ccac989181909e2ec8bcde514c9d1e67f2f4d1a9711f247321800c9957592ca2857880", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410380, "uuid": "cc9e1774-f10c-477e-b04f-1e5c8d06c1bf", "value": "T13CC312775AE2E381D6EB2C384B19CB03CABBD07CA42D9857CA5C0FC7A5E04AC525D136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410380, "uuid": "b0f62d51-3e27-489c-838a-f4a7ae976eec", "value": "3072:5+egL8pwBkFGYRHLYgM0AE0kAELO/dsKlgcCiSPdCCsywlR2j0s+c:5wBIGY9LYgCEdAEUgcmbM2Qs+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410380, "uuid": "c48cdce4-ceba-4ff2-ae0e-868d3caccb11", "value": 125173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410380, "uuid": "2aae2db0-9015-489d-a92c-8e9b986a1156", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410380, "uuid": "16692ae0-6a5a-4d51-8e86-c8ea7053c5fb", "value": "Entity ID.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea477de-2583-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633400831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400831, "uuid": "d54fc588-6942-476c-817c-cf7b5729ae07", "comment": "Malware payload (NanoCore)", "value": "861f5a2d35831fc651ecc80c62da3439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400831, "uuid": "4668c77f-03e6-484d-887d-25321af04237", "comment": "Malware payload (NanoCore)", "value": "d640ecb17d67d9e24983439f7d9bebb895ea8fb150bb7455c23c669dd7a45fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400831, "uuid": "5237193e-1c12-4c3d-a0d0-0834223e0bcc", "comment": "Malware payload (NanoCore)", "value": "c8bb43f6ecc4a10dc6f58d070c41cc44ae051e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633400831, "uuid": "56733ef9-0833-4372-9c24-9bcf86c66d69", "comment": "Malware payload (NanoCore)", "value": "c4cb92911a93051d0970153d8cc7e47b585d541624f501fa289921c20ced3a628e3eb880deac961b22653ac40fc1ae6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400831, "uuid": "fd8c5b76-2eb5-4b78-89bf-ce0bc9006820", "value": "T1CEE48DAC7623B5DFCE57C5718DA4AD74AB203CB6570B8203501771ECAE3DAA7CE540A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400831, "uuid": "93466b6a-42a1-4de4-8bf7-ec9104ebeb01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400831, "uuid": "aa45af4c-7370-4a29-b83e-d06e43647f08", "value": "12288:JlWGo1DnZ5pCTFYjWEDuRMZDHmxZD2VcDhJJerZsBBYxxv+Vvhe+Lc/mHnoWMjva:JlWGob5ETSjq868VcdJJDncvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633400831, "uuid": "99b1c9a5-1c6f-4f59-ba3f-1e84ad066e60", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633400831, "uuid": "06816589-b9b5-4390-afef-ba616278363a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633400831, "uuid": "22ae7b2d-4ef1-4bdc-9bff-58694fa38c84", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b257f5-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633413155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413155, "uuid": "0ef503ef-f781-4619-9b41-4622cfbc40cc", "comment": "Malware payload (AgentTesla)", "value": "f29c000509de5f75900d96114c925bf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413155, "uuid": "f6ab57b1-e802-49e7-9510-c2e8e78b0950", "comment": "Malware payload (AgentTesla)", "value": "d665b7da6b1d6ffdc910b074f4dea20204c275098a808f0a2eab717b6380e86f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413155, "uuid": "75065845-1f59-4c0e-afa4-994396923e29", "comment": "Malware payload (AgentTesla)", "value": "f48e4e4a679c273022fafa14e5357a453487cf02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413155, "uuid": "e0171132-313c-47ad-8cb8-8cd3406c2623", "comment": "Malware payload (AgentTesla)", "value": "5265190197e0aeba16e3f5d2c7aa1e21b62e019f8c2892b17b2821c2acaf0c4db35982a02b19a2a8de661adaa34c2e6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413155, "uuid": "e76120ba-cf7a-458e-9e27-13ae9c45c493", "value": "T1AFC4F13C96734B05CE388BFB3968E2A08379A198018EE77E5E8474FC3D67775996140B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413155, "uuid": "4f9f9d9a-09b1-4bdc-a6aa-44224720d3c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413155, "uuid": "7f70e61a-0720-49af-b329-c0fc241b8e89", "value": "12288:pMfjyiQEl/wuGdIpfqWHSncy9NDN8w3Vo:Ajya/f+I9DAcip8wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413155, "uuid": "175a65ed-bd20-4228-954f-dbfc1a7a4751", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413155, "uuid": "6d2b81da-b847-47eb-bc95-3b0346ba04ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413155, "uuid": "9867a32c-9320-4265-b11f-8138d14b876c", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5813899e-2602-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633455205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455205, "uuid": "ca0b9061-08ff-4d55-b8f0-64d74e95e9cd", "comment": "Malware payload", "value": "97c8a4a020e91a415d49f77293db32b2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455205, "uuid": "fa75420b-a19d-434e-ba4c-c7f0722ef37f", "comment": "Malware payload", "value": "d6c487b1fb3d31851921b343f3d131f7cb4c0469a60484037a6fa8cfbdc29dea", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455205, "uuid": "388c3c09-d437-4328-996d-d79c325a3171", "comment": "Malware payload", "value": "22d67ef270e69fdddd2a4a7a8986d575922fc14b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455205, "uuid": "b3e17f75-9437-4cd0-af1c-1679f76aeae8", "comment": "Malware payload", "value": "69ffc4c723fc604592c1c9a4ecc92f8eebcd6dcf55e132075aeef7145a370252e083a4d16a853e6e855b022560d622db", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455205, "uuid": "6fafef78-0ae2-44cd-bf0d-1978d7ea2978", "value": "T1D96307A7F295CC4AD95483320DEB87E26722FCC98E7E57473284BB1E2F386D45D02646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455205, "uuid": "d6b22fa1-de71-4024-be14-01800348ecae", "value": "1536:iScKoSsxz1PDZL2Qiw+4868O8K/5Le+k3hbdlylKsgqopeJBWhZFGkE+cL2NdAGe:iScKoSsxzNDZL2Qiw+4868O8K/5Le+kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633455205, "uuid": "8012fe77-aa90-45d2-a2c4-b2c45d279825", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633455205, "uuid": "f0667655-9822-4b2f-9dd3-89e9b585d46f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455205, "uuid": "3a23c902-a36b-40d4-af70-63d5f75fec67", "value": "wesco_276133865_20211005_15658110_276133865.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba335ff-25e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633443158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443158, "uuid": "946ddd07-8c3f-442b-bcb9-cde97c0c4030", "comment": "Malware payload (Metamorfo)", "value": "0ef1d0d4c8e09f6c99a21c01b3868764", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443158, "uuid": "28758bdf-d03d-4c88-a38b-d1dc070016c4", "comment": "Malware payload (Metamorfo)", "value": "d6e6a28bc9dc59ed774cc9586395b2ce7aabd447b06bf5fa60a3681a47f0bf39", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443158, "uuid": "51902574-4e1a-4f4b-bd64-939c4ed10459", "comment": "Malware payload (Metamorfo)", "value": "83b103dc5fdaa052d60f57a784fbd9aec4290544", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443158, "uuid": "d88553ce-bd50-4fde-920f-316c8b32375e", "comment": "Malware payload (Metamorfo)", "value": "6c4c59e324f6975cc733cc62ffb091eb746e6fe00da444b5d4f0a22eb3f862fc4576dc82754573120f69c228a46c7d19", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443158, "uuid": "0c9e76f3-1f1f-43ec-b6ed-4879184aa26d", "value": "T14031A0051EE60329D3B38F7A1077A2474A76FC51AE935F5E808497DE28A1054FC35E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443158, "uuid": "8f576a2c-ecd5-4f4c-a794-fa89b9c9d177", "value": "24:8+JUHRlVo5kcbA+Ppl7d7+/P+vrMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+hlaN1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443158, "uuid": "f59405e7-741f-4396-ab2e-af014b8d476e", "value": 1540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443158, "uuid": "dd0a3fad-bfe3-4cd9-b87d-18675d393070", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443158, "uuid": "a2b59d6a-cc4e-4dea-b419-b5ba9e249a5b", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc1e85a-25f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633450382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450382, "uuid": "0f67c364-cc05-48e9-abda-51f555639ef3", "comment": "Malware payload (Formbook)", "value": "7e360ceb5c5948199b7a9528909e94b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450382, "uuid": "5e350b20-9843-441e-8041-9d3f2feb3510", "comment": "Malware payload (Formbook)", "value": "d733031bac48ebb66a6a12347c3fa50852da1023486f591679043ef07c9cad7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450382, "uuid": "9066cf74-8272-42e0-87f7-9c9fe8db3fe3", "comment": "Malware payload (Formbook)", "value": "1d74abc6d6e4e8d019215d25083d2213aa4ab952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450382, "uuid": "0817624e-cf66-4f8d-95ec-11334a375164", "comment": "Malware payload (Formbook)", "value": "bf7a4c82ea0fc0bb617e4b48cd99399bcff116e69825681a55af641fdc638b407ca923ead088600d1b68650300ca91c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450382, "uuid": "254bb020-61d6-466c-80d0-cc597c9f9d40", "value": "T1A4E4D6D053CB99C4B57B2139B0222CEBB47D630DF3AECF1151A77A938CBA750561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450382, "uuid": "16f8dc82-625f-460d-863f-813c7102fb23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450382, "uuid": "aef2e00d-cd6d-48df-878e-871302a22036", "value": "12288:P/TOI046Mnq0UnsO5lJkKzUvoPUu9YGN1u4b3bfZLE1A1HBOr17iX95QJ83L:KBNTRA1ArOR29a+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450382, "uuid": "c8059e88-abe4-4bbd-8986-c146518f2846", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450382, "uuid": "bf7c88d7-dfa3-4c4a-9a95-13c7d52363c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450382, "uuid": "5e8ac728-491b-4066-b896-092f3a22527d", "value": "BUSINESS FILES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18542d4a-25b5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633422026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422026, "uuid": "284e919a-26ff-42f9-a4cf-875d453be885", "comment": "Malware payload (Gozi)", "value": "b5a2d5064a0ef3b55ffe1b95b3e4731e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422026, "uuid": "15372d3a-ca66-4231-b706-1dc7a37099f2", "comment": "Malware payload (Gozi)", "value": "d777b797eca94ab48c10dd972009d28a3a1a9f01133fa156426e065657832527", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422026, "uuid": "e51ac131-7363-4bbe-9894-f99d9a6cf6e2", "comment": "Malware payload (Gozi)", "value": "4f3ee422c7482cf326f56baaecb42c723ef74581", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422026, "uuid": "b5ec0d35-7a3f-4082-b974-8df8f8362260", "comment": "Malware payload (Gozi)", "value": "ee37c0aaf0467ae2b96149cb27e99cc25b2b07ebaa8aecd62ff794d0854ed1174cef049b24cc64c82e0542834240101b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422026, "uuid": "0c822662-5f81-4237-b88c-3762783dae82", "value": "T10B437D9272D408E1C3925D302991BBE7BAFD87306178E081D7631AD669A19A3FD3D30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422026, "uuid": "ea1dc4f8-68c8-4f30-9f55-85d7213a6d7a", "value": "1536:cWm6Qc14dhgw2qlalXLFSiH9j39x8TKfRME/wkT:86n4dD2qlalbFx9joWfRMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422026, "uuid": "84a22eb7-f8e7-4e8f-a771-390af42dbcee", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422026, "uuid": "1c20ac0e-2353-4c20-bf84-d3015b0f09f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422026, "uuid": "c8ead1c3-13c2-46f5-a99a-f1ca8d2d7d83", "value": "2d70000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed10c40-25d3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633435083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435083, "uuid": "dd63613b-40ac-4024-aae9-8ed5c326aa92", "comment": "Malware payload", "value": "cc5075896e71d504c70e62599f26a4b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435083, "uuid": "180cf5c6-8d41-4116-918b-e1f0119a4ccc", "comment": "Malware payload", "value": "d79cb9384054edaac7ec9a86620d2436c9328ba8c7818d559ca23ffd4fbc8b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435083, "uuid": "e877cc5a-be42-4fce-ba09-54a4ba5d40d1", "comment": "Malware payload", "value": "c001ca101ed73cf2c505f55f02d13a8ff39a05ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633435083, "uuid": "38296a0c-8b94-425a-a946-b8d6cfa2ac07", "comment": "Malware payload", "value": "c6057401197c2ae32a44f794a6d2a4f1dd24a865240e78df6ddec22d09dbb9a611ee5cb7a4823b30b35ac8d2e9f69410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maxtrilha", "colour": "#993ED0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435083, "uuid": "2a54134d-0e53-4664-8a45-ab79f03d4164", "value": "T133E6186FA9A28278C11EC17BC0B29F08B43374F81327C5FB976806685E65ED48D7F619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435083, "uuid": "e80dbd32-4774-42c3-aa58-93752adf0e28", "value": "6063dbecb2b02dae1f65a51959e1f126", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435083, "uuid": "7f184a8c-6ff0-4270-9922-02e12d0121a5", "value": "98304:B6CoweSckoBXoP1O6nTJOuwJ7/iAXflijzJk:B6GeSckou7T4uwXXf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633435083, "uuid": "f33cacec-903e-4bbe-920c-4910c08f0e38", "value": 13964800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633435083, "uuid": "e5260b37-dc48-476e-a128-750a99294990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633435083, "uuid": "d9980cea-35a2-450e-9a7a-59647fa073f1", "value": "maxtrilha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0da8127-25a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633415410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415410, "uuid": "ee334554-aa2d-456b-b38d-ba5e4fadf770", "comment": "Malware payload (Metamorfo)", "value": "fd556c4c36b36083230a802a8583c85a", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415410, "uuid": "81ffd93c-6831-450b-8bb2-b9fcbb68c59d", "comment": "Malware payload (Metamorfo)", "value": "d8411e1a70e9b96000c41c5d6528c206f6176a0723a05cd0f95c0a4ef5cb4353", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415410, "uuid": "7bd001d3-d3b3-4f9c-82d0-ba0a0a070cee", "comment": "Malware payload (Metamorfo)", "value": "02b208e9b36828759ead6937a66cacf21c6dd334", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415410, "uuid": "be28d1e4-afa4-4a10-9989-6f4cfb2ea159", "comment": "Malware payload (Metamorfo)", "value": "9089d1c8b2ecfe393e05c69f5ba76029721248bb8bbf46d613858f310eeed553aadfb8af9ae289ce3192112fb3b5e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415410, "uuid": "3ae3a55d-aa53-42a6-b8a3-f265e0915a3e", "value": "T18E31DD051ED60729C3B78F7A107BA2464A76FC91EE934F9E808487DE28A1054EC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415410, "uuid": "80918331-09b7-49ee-9495-cf6a38c2fadf", "value": "24:8+JUHRlVo5kcbA+PplYc+/P+C5Mj41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+hlYT9L1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415410, "uuid": "4459c8dd-84f1-42c7-b47a-7d292c339a9b", "value": 1508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415410, "uuid": "fa8948a8-0ee5-4b8b-a32a-bf8c515d213d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415410, "uuid": "a8e3e9a9-a858-4e61-87c5-9791aaf866b8", "value": "Outubro.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67142ba4-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633440627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440627, "uuid": "aec804a0-3165-44db-8219-cd6e5f1e05fb", "comment": "Malware payload", "value": "590540989a6ed3c787dc1c5bc934b403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440627, "uuid": "1b77c2f4-fc6d-4b2b-9287-839d7d54c0d1", "comment": "Malware payload", "value": "d8874883873ad6335451f6eca77c36fb4a894440d10a2f61fdba9eaab7bf72a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440627, "uuid": "8327ab19-8100-480a-90ab-2f66f568606e", "comment": "Malware payload", "value": "afa7a135c06349e42e4363ea73c66f124a865714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440627, "uuid": "bad7801d-efef-41d4-a16b-db810e3d8d89", "comment": "Malware payload", "value": "702fb90bcd20335dcbcdda27a20e531d94eb652875da7bc681dcf65a3152398efdef72305ac540aa3235ae8898d92aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440627, "uuid": "b1d2a99d-0b8e-43e1-8c7e-a505b232710f", "value": "T1E67412431B9244EBC05281B01DBE9EB9F1F6C70A40F5D90BD3728F7F2AA435F99464A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440627, "uuid": "71ebd517-4b98-420f-94c8-fb6ea2de71ee", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440627, "uuid": "677f6daf-87ca-450f-be5a-9545e323a7c1", "value": "6144:F8LxBsESMj17hexkP9yS5UoMO1WslFNHs9fXqmawrggZ7h92UsbnE:/ESHuEI7lXHslr9l92UeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440627, "uuid": "3974c49b-80d6-4cb2-93dc-e25df68db2d1", "value": 350989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440627, "uuid": "f9e607ff-391a-486d-84d3-3470d4d07379", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440627, "uuid": "9eb7971e-8e9d-4160-9b84-a86a614838eb", "value": "PO 001 OPHTHALMOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c70a968-257d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633398196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398196, "uuid": "fdf3b806-2f87-443f-92c4-99a2e543e45d", "comment": "Malware payload (AgentTesla)", "value": "4abc83ded19d6d2db57f3e91a4d3a8d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398196, "uuid": "962063ce-55e7-4c6f-8680-d06d6a40b229", "comment": "Malware payload (AgentTesla)", "value": "d9f807db5c31a21eabd5d62a3279d5e051e2b08fe1a4b701f9ffc8c2533ad8e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398196, "uuid": "3c25dbed-aeea-49a9-a979-cb9bfd09e342", "comment": "Malware payload (AgentTesla)", "value": "5be4754006c429c24f59ccb6ddc0cb0b0235cfc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633398196, "uuid": "4d4d4cd8-afad-429f-91f0-eaddd77c78c7", "comment": "Malware payload (AgentTesla)", "value": "a248040a8263426edae0aa47d9b22217964c5b37b889d5718705664ade30acb5271c039331e650e0366447060de67b5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398196, "uuid": "ccd0e504-aa80-4936-924a-791d4464308a", "value": "T1A6F4D0A4B743D607CE754BF028AEE2005339AE111649C32E7D49B6BD1D73B742A8CDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398196, "uuid": "5e15e7bf-1216-4781-af60-e282353a9999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398196, "uuid": "1961905b-7101-4990-9650-028cee46083c", "value": "6144:yFhWjQ+3HwOExxbKiuizeCkoLunD3Allpf9cL78RPdpcO2wjnkk1UVN5:MotiZ9kUurM12LIDkke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633398196, "uuid": "8c0d7351-e84e-407c-997d-3d9a89acb17f", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633398196, "uuid": "bc101a31-3990-454b-80b9-905217537572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633398196, "uuid": "6cdbc9b4-5f03-41f6-bbd5-5a9b2c5f9396", "value": "Informe bancario.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f30321a-25df-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1633440211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440211, "uuid": "cc3d905f-68f8-42a0-a372-e1dcb3688cb0", "comment": "Malware payload (Hydra)", "value": "4bab607247feb6002ac4e3d31ac0bef7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440211, "uuid": "d7474afe-6b8e-4625-9a60-7b3ec9f370bd", "comment": "Malware payload (Hydra)", "value": "da61bb04b91120fab02e374d6f4001728dc5736c4e3ac011841fb1523d3ed3be", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440211, "uuid": "a844bc47-3da3-46e0-9757-9dbdb65a3182", "comment": "Malware payload (Hydra)", "value": "e1f7d9b622b7e46706287ac540e92d0bb6eea422", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440211, "uuid": "f3a0bc2f-258b-45f9-bcc6-0188e86f20f6", "comment": "Malware payload (Hydra)", "value": "bb5f966e176233e2cc55be5bb06b8fc3290e2c769e244f62b9c3e6b8c26d0fd697a8602442a7b5836ab9281a5b46adde", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440211, "uuid": "94941b84-2dbc-4cca-a345-d859694c8252", "value": "T10C963381D6953A91E62EA9B38489518A371027976283845F82843F51CBD2DDF3BCFC6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440211, "uuid": "4d6d1fce-6141-4a68-a4b7-4140f90bbe11", "value": "196608:NNGxBgkFQ01RjHZUm6yNIqMDWx0RiQdyjynFAL9L:NH01p5U12IqYWabyj40L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440211, "uuid": "086f9487-6c1a-4b8c-90ee-fc1d12804788", "value": 9239608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440211, "uuid": "84effc65-0ad5-45ad-a506-38e2515d06d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440211, "uuid": "ee3a18f3-ad5c-4fc2-908d-fcd1ad63e48b", "value": "commerzbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc12dbec-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436958, "uuid": "aa52966e-b228-4149-ab41-a78c36ed43ab", "comment": "Malware payload (SnakeKeylogger)", "value": "b0be1110416b69d81be348d1afde476a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436958, "uuid": "31e6118e-003a-44b3-ae68-b6f019e74c2c", "comment": "Malware payload (SnakeKeylogger)", "value": "da89b1114795737b1d898d93e0b504b900a51d352fe5c18d46946e4b6b64f686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436958, "uuid": "13b2a376-2401-4f9d-a436-b8640ab9f306", "comment": "Malware payload (SnakeKeylogger)", "value": "5605d26240dd38d80c374d95141c219cc398eee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436958, "uuid": "fcb10244-dcf9-4c2a-aa95-fb2f60e47fed", "comment": "Malware payload (SnakeKeylogger)", "value": "4afd58c02ad1671c9ec920ce0aad63579308edb324cd6938714137850a46dcd5fd1c36a3fa1652e01e3c68ac1f2ca02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436958, "uuid": "dd0389e3-7637-4e04-8288-59fcbf3e76a2", "value": "T17C94BF9433AFAF45ED388FF4152C919153B96C3B5169D76A0ED1B0EE2D22BB00E90B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436958, "uuid": "2ff25b82-a482-478f-b613-82c74da994fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436958, "uuid": "674a9a52-5a9e-4d47-9cb1-6a5207ace826", "value": "6144:UnFcbCrMorCnhdQ+3HwOcc0W36Ru53d6nvAiQ70IirrsPnKPhYZzkHwLnz8HDEW:QwWocc0WqRuEvAiQ7irQy+ZkgzIDEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436958, "uuid": "05c70c18-3932-4c97-a025-f6f5209788f1", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436958, "uuid": "baab5245-8ab4-47a1-aaee-27dbe1c6a2da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436958, "uuid": "4305e10a-d613-44d6-ae32-33084403a095", "value": "Purchase Order No. GN-205603-004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fa0d3c-2587-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633402316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633402316, "uuid": "5cf2d878-60c3-42f5-b8ea-344cdc95782e", "comment": "Malware payload (AgentTesla)", "value": "3e393190615b2fb236b8bf110e5b723e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633402316, "uuid": "c7edab31-c414-4d18-af45-037d8fdb055e", "comment": "Malware payload (AgentTesla)", "value": "db090766677598179be49b4abb58e425d185aea054df18a7a8b873147faf3316", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633402316, "uuid": "36f1f0f5-7e56-47fb-b1d0-04b09beeb76c", "comment": "Malware payload (AgentTesla)", "value": "f85f14312f9682ee671a3115ea3df50facdfc76b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633402316, "uuid": "1e1e269d-352d-4d47-8137-679e73c5ceea", "comment": "Malware payload (AgentTesla)", "value": "88af7bf601bab7c8599273ab061bca00b4f124692290ce1e176de5a7b310360604fa0293c4f27b5512fbcc6fbe63241c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633402316, "uuid": "69a774f9-c531-432c-a16b-c585cf113bf6", "value": "T135D48DACB64335DECC17C5B199682C64AB613CBB530F8213601771ADAE3DAA7DF540A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633402316, "uuid": "c66a128d-99f7-4323-b8ca-f56a7e55f9ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633402316, "uuid": "16d44c30-316e-4377-a30a-4f60248090bb", "value": "12288:HVj4oMdKGrtUYqYWIhIos7AF47SgjWvS+u7OjXeZHUs3RcJD3Lo0o9:CosKGrtFDCSgabXho9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633402316, "uuid": "0d230146-5303-4f7f-a715-b5769401d16c", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633402316, "uuid": "32bb2315-1937-468c-8225-708f9a1f67be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633402316, "uuid": "ffd79e33-b93a-4006-afa9-7b30dcea51ac", "value": "Pictures+details.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d266b12d-2599-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633410313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410313, "uuid": "469d5064-8b35-4884-b606-d14f9711ba52", "comment": "Malware payload", "value": "5dd89d8c1300af129771ae59a616a44e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410313, "uuid": "a3211176-4bc3-4553-b303-8f47a8f50033", "comment": "Malware payload", "value": "db336333cb801043a7947aac00d439b2b5985ba38b1af34493d96120eb3bd542", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410313, "uuid": "b2d621cd-9105-4ebb-a2aa-ab0f3d47debe", "comment": "Malware payload", "value": "9531be3f8d6f1cfb13ffe49339d7fb4bee47502a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410313, "uuid": "49215b51-61c7-4f9d-b900-0d2156108178", "comment": "Malware payload", "value": "8154eb8f1030225cd1cdba33e291d634d4bee80fcfd1f20310be4db1b8d51811df63fb00768197b4e40f95e4aa76b920", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410313, "uuid": "e3038121-71fd-4247-a0d0-eed435622e99", "value": "T18A641245B7CD2E56C80B61B17C05C9A31B1CCD6A9F0AD3129612FD6E9BB27C40CD2BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410313, "uuid": "36bee093-baf9-49a3-a40a-601cbe22a97e", "value": "6144:IbRygI+V137jR2l/svTEETpbXTEoYR2TRhf5xKJFgbdy3:IDjR2NsbPDTlhfP+FgpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410313, "uuid": "9babd356-ab16-4e50-9dfb-6f6eaafe70c7", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410313, "uuid": "d0cc36bd-5036-477a-8d9f-88fcf3293b51", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410313, "uuid": "75010b34-de25-4183-b227-9243c5c34ae9", "value": "10-04-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f5b72d-25ce-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633432740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432740, "uuid": "0476da66-bf39-4102-97e6-2609ee72f061", "comment": "Malware payload (GuLoader)", "value": "f5f125541941fd9f962538d8c581353a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432740, "uuid": "d9fe21e6-0f68-46a8-a1d4-551418469089", "comment": "Malware payload (GuLoader)", "value": "dbe0534852b9bdfd87ad541eca9858715657c52265a9e3e15ed7c2e439e79db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432740, "uuid": "78500feb-e37c-449c-ba84-c25afa0d474e", "comment": "Malware payload (GuLoader)", "value": "8c0ee2478caeff40c4d9dbf48112171000c01d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432740, "uuid": "fa8688ee-33e9-48cc-bb5b-37b4c75014d9", "comment": "Malware payload (GuLoader)", "value": "00fb087da5f3a6b3ec063195b323015164a4cce2cb208eec972db7d556a82c7a719c4c8bcf6d44152abefdf768bc8816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432740, "uuid": "2c4c21f5-3207-4a5e-a968-aa03ebf8a663", "value": "T1D6B38E27E7894A75D589DCF0359BB2E7174BFD20D1100F5F3088FAA9AEB04EE65A0346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432740, "uuid": "3490b378-7dd4-4d63-8c5d-6db49239fb28", "value": "a661671ef02a6d0e6a34eab52e2e0015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432740, "uuid": "245278d7-f220-4878-b1cf-caa5fee30e41", "value": "1536:UNmVWPwue5maxBOktg9XhJM/OV0m3JxUV9IMG127:RW48aDOAg6OdmV9IVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432740, "uuid": "4f696e75-d078-491b-8d4e-a5ea8a5dd740", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432740, "uuid": "e738df0f-88bb-47f2-999d-c3fe8e489594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432740, "uuid": "efdccc2e-8035-410d-ada7-6b28b549c1af", "value": "Justificante de la transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b672b85b-25fb-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633452356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452356, "uuid": "be57a470-8123-48e3-9369-f3045d7de2d0", "comment": "Malware payload (AsyncRAT)", "value": "d8378c37faf55c88b8cab4830aa4e4ee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452356, "uuid": "4c830d09-3e5a-444b-9fd2-1437b9e4d948", "comment": "Malware payload (AsyncRAT)", "value": "dc071cd2559b6cdd7d151ff030189e89ff1af15aa060d89ea5ab9077da2b23c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452356, "uuid": "a17c54cc-834b-4a96-8710-383bf9bcb9fd", "comment": "Malware payload (AsyncRAT)", "value": "a3507cef8071d140d47e8ee90d28ae142da277b8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633452356, "uuid": "acef7ea3-d61a-4038-ad4e-9982c5d50df1", "comment": "Malware payload (AsyncRAT)", "value": "4498e6bbf7de3fb9235c49ce088e73fa22e36f6683dce7a184d8a34ae9dbd14b2d0c196a676133a0fa43550d4027cd2b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452356, "uuid": "9aebac53-c7d8-44b3-b2c6-cc01f527ba9c", "value": "T1F9016240E0BDEAB689C272670CCB68A1B538248B8370EA5D2030D661C57D7F8E0ED282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452356, "uuid": "e2d48b23-2026-42ab-8446-7a3b3efa7c78", "value": "12:lEggUMa6augd3pm9iV5R9Gg2IIxmZ9y5HMTCo6R9Gg4rWb:l36au2EUMg2IIxmZcCOoeMg4r6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633452356, "uuid": "abaada3c-0a69-4750-bab5-ce0df16d5336", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633452356, "uuid": "68a9bf14-63a1-46f7-bc7d-1a2d9ef4ab8f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633452356, "uuid": "5f79a9e6-ef86-42b8-9b9c-0a30ee791c07", "value": "AIXHM8275.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d07f84-260d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633460200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633460200, "uuid": "fb42f59f-06f1-4d9a-a0b8-6182e88ff779", "comment": "Malware payload (AgentTesla)", "value": "e6c49e077a5dbc19010deb67b66d2baf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633460200, "uuid": "eed433e8-653a-47b9-b7eb-8148a86a9376", "comment": "Malware payload (AgentTesla)", "value": "dc7f968c3675e128b31f4cc335db4315a337af8be71daa6faef726f1a4cbbd12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633460200, "uuid": "34cd41a3-6ee1-42d9-8466-f0f0460b49fd", "comment": "Malware payload (AgentTesla)", "value": "6f31a8f5867b6f98d4942cc3816b4faf7f5eceae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633460200, "uuid": "bae046dd-924a-4aab-9f89-bff9ecfb7cab", "comment": "Malware payload (AgentTesla)", "value": "d6b226ea2969c4172e7ed4a792e870fa246d1fc8a509987c909caa9ee36fd8791f8aabc1bdc7be2afefa3161a17026f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633460200, "uuid": "205fc6f0-dc58-4933-ba63-12dae3cc6116", "value": "T165D49E653183EC45CFA51EB6C8CF805407BAAC376056CB2A3A9E72EC65123F3AC455CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633460200, "uuid": "9c035785-c00d-4329-93f2-9db8850c127e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633460200, "uuid": "cfe9feb8-977b-4a72-92cb-445cf9888a23", "value": "12288:3dCnN72XRlqtovc0WgkeofXtBZgDjM6wRpPDWNo:1hMtEc0WjeAFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633460200, "uuid": "c6b32e6c-4b0b-43fc-8f70-07243dbeaeeb", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633460200, "uuid": "6ec4a1c4-2bbd-4f60-9fc6-167ecd2be240", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633460200, "uuid": "74029995-3f02-418e-b098-8ae01867bb16", "value": "statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316dbd0e-25a5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633415197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415197, "uuid": "33fb216d-c914-40da-8b1a-99361c51ea52", "comment": "Malware payload (RedLineStealer)", "value": "ccbb2472187b8bf5e92167e2699b60f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415197, "uuid": "1fea9ed2-1ce2-4187-ac4e-b50f14330cfd", "comment": "Malware payload (RedLineStealer)", "value": "dc9784a2720a8def3aa2c6637ad50428cb823b037a3d144517ff0c1737ac87f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415197, "uuid": "c4583baa-f3e4-4bf9-aafb-b916f5675a75", "comment": "Malware payload (RedLineStealer)", "value": "7617637b28e59fabe70eecffa59e766d29abd858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633415197, "uuid": "e3d24b51-2003-46a7-9ac5-91dc6724da7c", "comment": "Malware payload (RedLineStealer)", "value": "400a072fa15a5de1cfd08133197a9b80e5b0616c27c5ca676d0d671ec718f78365d69c64b36783c9c2e5dbbf1c160d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415197, "uuid": "634fa964-f81e-472c-a532-836b063e05bb", "value": "T182656A54F516DAB2E24A07B5C0E34044C3AA5F61669AE71F3EE776DD28213CBA80CD4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415197, "uuid": "c38494b4-b67e-490a-90dc-eb797c574bad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415197, "uuid": "dc1e6ed9-1d2c-43ee-9c9b-8067d3014e61", "value": "24576:xCqQSnk5EW+o5ImP01T6idQrl28zbMc7WV6Hjk1nQg:x6eg+oB01ndQVz4c7WgDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633415197, "uuid": "0350e110-3996-45f9-9485-287e8aec764d", "value": 1444864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633415197, "uuid": "f16c9e77-1be8-48a9-be22-8ce7bfa86acd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633415197, "uuid": "b3466d33-b8bc-456e-94ee-6f47b266e815", "value": "ccbb2472187b8bf5e92167e2699b60f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c43f61-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633417031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417031, "uuid": "a6ea9857-46e0-470b-b619-4611449b6764", "comment": "Malware payload (NanoCore)", "value": "112a750d6ba279a9bdc864396653e617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417031, "uuid": "c93ff2a3-48ea-44fe-932b-d949b7daf3f9", "comment": "Malware payload (NanoCore)", "value": "dc98b9f2d0453e7a91f2ddcdec5cead4ee362d53f5ba5f528cd461e566565d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417031, "uuid": "13b99a2a-10fd-4340-82c8-aa59a4c10be6", "comment": "Malware payload (NanoCore)", "value": "bfd5d39be42f5926a6a06e2fc60eaa69f1ff3909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417031, "uuid": "8f390de5-acb1-486b-ad4d-0db027a93c91", "comment": "Malware payload (NanoCore)", "value": "8ac1fb7bc38f6dc58a4b06251459e8ad01684d6950dbb354ed89fb658195b4db711b597b786c6635451e992a2c0407dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417031, "uuid": "b75bc68c-2c70-42c8-bd2d-8d3199cdca15", "value": "T132641207E5C544D2ED6257B01A7AFE687937BF2E61352C8F6BA47A6325331C3042B24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417031, "uuid": "b39bcccc-3edc-4651-b106-3283f362b79d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417031, "uuid": "b27b9888-fc82-44ea-babf-f56108581703", "value": "6144:F8LxBdMtrixpf50lwIonaLsGCWANjMkHHwnsxxst44iu5bta:xOF0TonaLsDMvsot/tbta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417031, "uuid": "1fc75ca7-8da6-4f82-a790-abc41d99356b", "value": 335279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417031, "uuid": "45cb5a33-62e9-4545-8f31-df04a8ba1827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417031, "uuid": "daed5bbb-bf74-497f-a365-fe56afdd516d", "value": "Yeni Sipari\u015f # 765-3523663, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9994ea6e-25f7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633450590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450590, "uuid": "edaf54b8-0308-4b27-87dd-febf3972a772", "comment": "Malware payload (RaccoonStealer)", "value": "5d5aa63549dcf038cec21c54c0c5505d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450590, "uuid": "1060f210-586f-45a4-8f8f-1faa89decb21", "comment": "Malware payload (RaccoonStealer)", "value": "dcff0727ff7809cddf9d0ca02725f70ead9eff5799cdef37b2b05fee166bc5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450590, "uuid": "a5cedef0-77e7-4a7d-9075-4f761bbf61f6", "comment": "Malware payload (RaccoonStealer)", "value": "31d023050ebcb15fcb47feb3e8f1fc12f0f8fa5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450590, "uuid": "f5130ea3-86c9-423d-b035-a06124b47a2a", "comment": "Malware payload (RaccoonStealer)", "value": "7ff722eab1b927ec9814b8f6469c18397edac4510ae16bbe9007ff7f4f74f4e2ddd38be4d029668c3441710298739753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450590, "uuid": "4f40cc76-ab8d-40da-b78a-9fb006da95c9", "value": "T17A349D11B7E0C035F4B712FA497993B5A93D7EB06F2491CB52C11AEA9A342E4ED30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450590, "uuid": "f32a22f8-d147-4092-b0ea-c0b75c590750", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450590, "uuid": "294e2c8d-937b-4e48-aa08-80f33a2fbcaf", "value": "3072:1oGYaWurHGP6k/njDjGJt5ejQxpOrZEBFmVw80jspay2ccA9hoKiygUgAWakhg0v:1oyLS6dKQxkrUFmVgrSh3qMtOx4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450590, "uuid": "ae0550c9-5f64-4234-8333-0de9da989814", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450590, "uuid": "79a6ff13-3e8d-41d7-92d5-b3f54e79e3c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450590, "uuid": "2d58089e-21b7-408e-b1cb-b40a75c63dac", "value": "5d5aa63549dcf038cec21c54c0c5505d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed84959-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633412991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412991, "uuid": "245bc9f6-fa52-4f46-9a11-35d959a8e9b0", "comment": "Malware payload (AgentTesla)", "value": "c24c9f40312171cdf32ec38ca247bd20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412991, "uuid": "68a3207e-be58-40ec-b920-9de60d93a7da", "comment": "Malware payload (AgentTesla)", "value": "dd66c2c1bacad7d65df979940b4b3620c632aba497e6f2f2d99c27f0d080d8c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412991, "uuid": "44516825-5d60-4936-9697-a7ffc9c6b19b", "comment": "Malware payload (AgentTesla)", "value": "3a8c17cf2d1d9447cec5bce7e04d29661efa0312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412991, "uuid": "15b3219c-a35d-4577-a8d8-ad5c9a735c4d", "comment": "Malware payload (AgentTesla)", "value": "71c1544a3fed151063f4415d9a05ebd680fceb5988d641220b2e3dedf87d2c9a62b9728e9a01694c022c43971d725ff8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412991, "uuid": "5d8c7aed-e4e9-4019-885a-091223c8a601", "value": "T127E46CAC7673FDAECD17C07B8A583D60AF2C2CA6431B7212501771A9AD7C996DF500E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412991, "uuid": "7ba360da-ac05-43af-8a92-4aa8fb1eeb6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412991, "uuid": "b5e54b89-f9e4-4ece-9096-36578821566b", "value": "12288:EHNo3TkOlxgAtePAZnLYd/5bKujJJD5/ZIvMpo0:EtOzgAtSAZMNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412991, "uuid": "749241a4-a80e-442c-8f5c-5415bde671e4", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412991, "uuid": "a1a4986f-77bc-4fb6-95e7-24b42def74a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412991, "uuid": "75db91bd-ff47-427b-9a8c-8c16798abf4e", "value": "RFQ # 1667170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0084d7-25fd-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633453334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453334, "uuid": "bac6f0d1-d360-48ea-889b-50c409b0c542", "comment": "Malware payload (AsyncRAT)", "value": "dbed7639a40c39f08b830fd657b7af95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453334, "uuid": "b1fc1996-22b3-46a6-950c-8870e854d553", "comment": "Malware payload (AsyncRAT)", "value": "dd9a1392452c3b1a42a6d6e6c3fa30b32d2da5359bfe6e8f3a842e70c1e752d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453334, "uuid": "c66aec5d-d1fc-4919-ae8f-bc401037e85b", "comment": "Malware payload (AsyncRAT)", "value": "65e6b4de2f2243383c04532d747b2e9453bf63c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453334, "uuid": "4af9b27a-7a9b-4485-8b3e-f2f1da2b5cf0", "comment": "Malware payload (AsyncRAT)", "value": "616b9c862a72d90dfb419b837ebaf311493a8142fa81d3bfb9ed759d141c783e1070021d63e79b4151e14a806eaa130c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453334, "uuid": "5ab5a79e-3e43-436f-acfe-9e73e4de110d", "value": "T15D747BAC321476EFCC2BCA768A981C38AA50A477432B9107942781DDDE4D9C7DF652F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453334, "uuid": "ac8b0934-23cc-4ff8-8160-b369bc1c2b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453334, "uuid": "f975cc89-a896-4be3-ae25-9b5c129f4c18", "value": "6144:Qbg8R5GJHrTfmEgqutGDsm5sMjmQIYOwO8hTS2moO3gRzKMyw8zkvGRlyM:f9HrTrgTtdL//wXO2mov+A8zIGRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633453334, "uuid": "acc93d9b-3e44-4301-8ad0-7fd4cf36b267", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633453334, "uuid": "e05f6c5d-06c1-4135-bb0b-6546deccc03d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453334, "uuid": "e2d22187-66c9-4cf6-abe5-4047e2d9219b", "value": "Application Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1a4c01-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633411864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411864, "uuid": "70e66608-f0d3-475a-86f5-798c5e227fb9", "comment": "Malware payload (RaccoonStealer)", "value": "daccc17793a5eb46b008b9402c67067f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411864, "uuid": "751351fb-88d4-4e3e-93a3-8f9c2d8b473f", "comment": "Malware payload (RaccoonStealer)", "value": "ddbb4705216cb4790d9bd04a3388df2b7e728486183d9eab7e46789ca5655d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411864, "uuid": "56aa4155-9ef0-4923-832d-996f3f539fc3", "comment": "Malware payload (RaccoonStealer)", "value": "09d31f75596eaac712f1bf8ed16b423c840c95f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411864, "uuid": "491303a9-26c5-4ace-8f75-459aa212fa7b", "comment": "Malware payload (RaccoonStealer)", "value": "36e4e970e2a9986ff94f559381d71010391c30d0946c93adb32c34865731af92fa1092aa036348bf45fa6318f46e1c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411864, "uuid": "2c8c9bc0-5782-4e4d-8d10-82f9dd4e8b6b", "value": "T1FEC4F11071F3DAF1E62645B17625C6E68736BD6D3D21718B7B90264F3F382E29B22702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411864, "uuid": "9c288ee8-feb9-4665-92c1-32aa6e296044", "value": "8edc63b1e502813168c877f42e306db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411864, "uuid": "b282f158-bcc5-4d67-9096-019bd635a35f", "value": "12288:StGO7fJ4CEtV53JPblM38Q5GPu64ZiwxYQ6fyw/jL4An0B19b:SwO7B4dv3JPojGPu6z2h6fyQL4ZXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411864, "uuid": "c35aea8c-0dc6-4134-9bc6-faa6c86d9b7c", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411864, "uuid": "e1e95b71-755d-4f4a-90f0-8a7c34a05f24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411864, "uuid": "01f0ea49-7f4b-48c6-83fd-b2fdcae3d9fc", "value": "daccc17793a5eb46b008b9402c67067f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdd914c-2610-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633461467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461467, "uuid": "80b9fa89-7918-455e-be08-47b716281e0d", "comment": "Malware payload (NanoCore)", "value": "4001a4964d67f77eaa858c20ef93f4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461467, "uuid": "4cffcce1-d2f0-4e98-8485-82643dad1952", "comment": "Malware payload (NanoCore)", "value": "df6072d3ab7c2a29c39113770148b2e3e1d10f4169dc1199d188349a5e1930c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461467, "uuid": "b5920b51-088e-4cc6-a775-eceb68c18429", "comment": "Malware payload (NanoCore)", "value": "d0a46b5ac4c655b75696d47bd90fd0dd146e4921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633461467, "uuid": "3ad87d6a-dc43-427a-be96-1151305a87d4", "comment": "Malware payload (NanoCore)", "value": "217ea5b7c57bdb53b89ac81290ae45b141288823fb6f2dbfd201d0c97b85341d71be088da1f19127eb485f0a7784b752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461467, "uuid": "68eff576-defa-4877-8c8c-27424c8b5769", "value": "T11BC3C622139C5E21D77C977B256641000BF8A4139333D30FBCDF46DD4A55BAEAA27B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461467, "uuid": "93ee93d7-a277-4c2a-a617-2feca9efd51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461467, "uuid": "8915ec89-bd90-4a70-a0f1-77dc75c23d6c", "value": "3072:E9Arqs8rPOHjQ8WYT9v5rVnxjN/J7l3BzdPZL1HRDtfpbFXhT9v5rVnxjN/JBzdk:EarqsZHM8WYT9v5rVnxjN/J7l3BzdPZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633461467, "uuid": "51542e73-9f7d-4100-9a50-dff51bd58aa7", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633461467, "uuid": "bee2e273-1930-4204-a6a8-46b3ecf1d66a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633461467, "uuid": "0660375c-6ac1-4c66-bfd7-087cc28a4744", "value": "4001a4964d67f77eaa858c20ef93f4a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cdc6d7-25dd-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633439583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439583, "uuid": "0cd8473a-5dc4-4ec5-a3c7-89dbbb6f9213", "comment": "Malware payload (SnakeKeylogger)", "value": "36ffe644c4a67459c2ffe39a049caffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439583, "uuid": "19f47e39-919a-4029-a3c1-163e9bfc8622", "comment": "Malware payload (SnakeKeylogger)", "value": "df758d3c1f62d8e80fc921d80bf583acd370e4316ec846378d22b691e3d3c1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439583, "uuid": "2a8e2c20-7c5f-4f79-9cec-2e1ec611b031", "comment": "Malware payload (SnakeKeylogger)", "value": "802621d2a63e3b1cc1a2851eea12eb587d3b5ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633439583, "uuid": "474992b1-2c7e-4a02-980d-38974537ae41", "comment": "Malware payload (SnakeKeylogger)", "value": "782f2cc3b582890e0490b2bb921f28042747c67283facc83c3ca8d10ccb6c9388c0f91c22fbaa1bfa4228b9673f92956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439583, "uuid": "045da114-277b-4d5b-b334-ed29a16cdac0", "value": "T17994BE54239FAF55ED758FF4182C909153F6AC3B1579D3690ED1B0EA2D32BB00A90BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439583, "uuid": "553bc148-acef-4e34-bddc-44ea3ba1e405", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439583, "uuid": "d25393e4-90f2-47ed-a779-1a7f893ba7c1", "value": "6144:/f5OCHPUnhsQ+3HwOcc0WTCI62woO8AlliWGPfDBP9eNFfPa58EYlVpk0W3sLU3:s9occ0WTd628JliVeNFfq6k0W3sLU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633439583, "uuid": "559888c9-d96f-4d27-b8ab-510e9d451a19", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633439583, "uuid": "2db7d97c-62c5-47dc-a592-614677a6e65c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633439583, "uuid": "19e30c0e-65d5-4039-ac05-bce24a7cc801", "value": "arab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9a3cc4-25a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633416400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416400, "uuid": "c8081ab4-c6ce-4882-9940-797f38596457", "comment": "Malware payload (RaccoonStealer)", "value": "bf5ecc8742c65937cf556bf5f46be727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416400, "uuid": "648e4ab3-8cbf-4f2a-bc88-3c5d4520b856", "comment": "Malware payload (RaccoonStealer)", "value": "dfb6ac4f7e465bf6e26ec7f9fc55a16803c2a36ae34a4acedba1d28a99c1d11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416400, "uuid": "746fc0e0-cad8-476d-b851-d5c59fe9c895", "comment": "Malware payload (RaccoonStealer)", "value": "40aa58b29e5ff594f5bc6693fd2e948abd4ef5f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416400, "uuid": "2752082d-41a3-4c6a-b494-776a56e85584", "comment": "Malware payload (RaccoonStealer)", "value": "e11829cb275664dfd58a412b9af2b0d2b72bf6807b9a747c81661d1b4bed7ce6696efe6867ea588956bd589931be1be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416400, "uuid": "b70cb914-91ba-4c7b-a748-44aac415f322", "value": "T1E7B4E030A7E1C030F5F712B548B593B9A92DBEB1A73490CF52E416EA6A346E4DC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416400, "uuid": "11b0354b-b8c1-4f13-8c6b-9a9f2696d30f", "value": "d5c5817e78a7773bc089fd8b02756f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416400, "uuid": "8844eb4d-9620-4f6c-9382-773817d6afbf", "value": "12288:66Y1B45eKltxocdtEoOipiTSPWG6iDJaYPI8wLl9LnM:g4xop6piehJM8wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416400, "uuid": "c0f4018c-37ba-42b8-9597-66fe283ebde5", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416400, "uuid": "5c807435-0970-44f8-ac5f-5d4eef6d162a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416400, "uuid": "63660409-37c2-4dbf-9546-a1fdf649516d", "value": "bf5ecc8742c65937cf556bf5f46be727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d256a2f-25b5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633422088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422088, "uuid": "360a32b8-6bfd-4b93-b0f6-a01857c79ae2", "comment": "Malware payload (AgentTesla)", "value": "ce2434f1e7cf62fb10e62123e59fb335", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422088, "uuid": "66422165-47b8-4e3e-8616-c384721e08da", "comment": "Malware payload (AgentTesla)", "value": "e10b640d750f080288d759b7fcce012ae090a27da56fdaf0acb0b3564336be9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422088, "uuid": "ff9e35c8-bb35-4aec-a603-a36049d3ed42", "comment": "Malware payload (AgentTesla)", "value": "88574730ae0748bde82f512d43e77134622c827e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633422088, "uuid": "d4fe1b68-4aa3-4a84-bc9c-f916f192bb68", "comment": "Malware payload (AgentTesla)", "value": "522c87d0f5eb5a5f9ee53dbce5b5340516f1310a5ed680da9aaed7b891e933f238acbd0eccb2da4e18d059b97f4e4d80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422088, "uuid": "4e4f19a6-cbfb-4ecc-a29f-956d55b5e01b", "value": "T19A256C6223C91B61F03E97BA91386549EFF1F4D7D365C94A7CDE12AB0F71E805A13A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422088, "uuid": "420133a7-9c1b-40c8-b5e8-007c9c567b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422088, "uuid": "8d531e94-81f1-456f-92d4-dccb518a322a", "value": "24576:v5PC7zJ/zJqzJ14TZEy8loWlvarBqKeE:v5PCrK7lvKqxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633422088, "uuid": "791242de-3ff8-40c5-8af7-db6304535a81", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633422088, "uuid": "788afa33-141c-4839-a3bc-238e39c2bff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633422088, "uuid": "1189ede6-46db-4f53-925e-3afef6bf1fa7", "value": "ce2434f1e7cf62fb10e62123e59fb335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723fcb11-25ce-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633432915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432915, "uuid": "fd8b07ea-3f19-45ab-b60d-3558abce21e9", "comment": "Malware payload (CobaltStrike)", "value": "7c766b8bfaba529f3752255eebe5e9d2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432915, "uuid": "fb0649d6-8580-4b7f-84da-159ead48087e", "comment": "Malware payload (CobaltStrike)", "value": "e16f25682655887cfe2bbaf1634210b901fbc9a8c17ffc7bad06912dfe6e8010", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432915, "uuid": "222e3689-8875-484b-a38d-f7af8b92570d", "comment": "Malware payload (CobaltStrike)", "value": "e877ff6dd108883a904742ce23ebd5e8e5151672", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633432915, "uuid": "06d66fcf-10f6-4b31-8989-5c0fdad8fa69", "comment": "Malware payload (CobaltStrike)", "value": "e54b55beba732880487302965277d0d80902a7b31373257c15a71a1aa8dd1138a066a21f476406186dc42770492a6e80", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432915, "uuid": "c14eac57-341c-4bfd-81f9-250f28b7c0a7", "value": "T15B24CE31360F3DBFF86549FC68D1103ADF65AEABDA9CCD4EDA9CA14046C994B0F12426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432915, "uuid": "247310ef-1a17-4e20-a762-fc46ed3d45de", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432915, "uuid": "43e1f3eb-6958-40af-969c-6a8aad47ed15", "value": "6144:PdbIm87Xx9Ux+iQoLPbQQ/30p2MpVxNk9a2wCgNK4:Plr87h9QQoHXc1S56j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633432915, "uuid": "bcc86a00-bad8-43ad-8ff0-673d5f734d30", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633432915, "uuid": "40cfb8d1-e489-443b-bcbf-e0a6d6dc03cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633432915, "uuid": "f803b316-8430-4043-becf-56c5120daa2d", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f7e015-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633413325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413325, "uuid": "7094b6ab-50b0-4c01-8406-edb110481f30", "comment": "Malware payload (AgentTesla)", "value": "b8f0b336b6ee0bfcc5192a0821c600a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413325, "uuid": "e4867cac-a3ce-4621-9419-24d42783d250", "comment": "Malware payload (AgentTesla)", "value": "e20d3bc1833032d26d6d3122f39890da7cab80c375d21698776fb9146d976f4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413325, "uuid": "8ecfd1c0-5b23-4ee4-a495-bc6dd518623c", "comment": "Malware payload (AgentTesla)", "value": "7f849c0ffa1be0363a9356e2982885d7d739a9f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413325, "uuid": "2482ea0c-cb30-41a5-a3bb-cde64e1d2676", "comment": "Malware payload (AgentTesla)", "value": "b7fcd1cff4ab8d23d7df41abbcb0658a0f0345601f2921579a2f04fa66ae47d77424762806c57538bb9aca94a6ff4273", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413325, "uuid": "b9434caa-843f-46dc-a1dd-d83c1c80e9fd", "value": "T1C5B4AE2039FB5129F1B3AF7A1EE075969A6FF6633A17E41D1441038B0B23B81DD9173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413325, "uuid": "3d5320ab-c490-4c70-a10f-05ee5f9d54a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413325, "uuid": "e70c7fff-6cfe-4536-a722-8e9c919efab0", "value": "12288:Cdk1k4DbF53e0IUFLwSwasdxhW6tUzhebs8zqxKZ/2wTxUUuGlM:CatkmsdxhvUzheYUROwTX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413325, "uuid": "a4800557-46c0-4f61-b492-ab32c8400752", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413325, "uuid": "04cf389e-c4c5-4726-b8b3-a66c18240fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413325, "uuid": "49839709-af01-45a6-bd28-1fc35d901f08", "value": "TRADE INQUIRY #20210914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86308a6b-25e3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633441968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441968, "uuid": "a71ebcf8-dce4-455a-aef9-d73197e30553", "comment": "Malware payload (NanoCore)", "value": "5fac4473e58b2fedf57ee47008bc7ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441968, "uuid": "fe6d7b4e-ee9c-433d-9a41-4ca2301241c3", "comment": "Malware payload (NanoCore)", "value": "e29ba35e420eca7fc5f429087856acf9aecc1644401c0627f4cfdca56ada48ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441968, "uuid": "5957041e-40f4-4114-a7a7-829fcad4f7dc", "comment": "Malware payload (NanoCore)", "value": "e4a2430eaba425686b53f0792688e2864068c9dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441968, "uuid": "fccd6fe4-61a8-467c-9584-8008df6fd5f2", "comment": "Malware payload (NanoCore)", "value": "4e14efe25ce67d8cebb6ddd5ebc26a4fb171a4c3f35f5372109db70f64b7b3f3c51d69f562bc6d99e0e7bc5fabd58551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441968, "uuid": "73fcd58b-61ec-4b87-8e81-e48a2b76a9e4", "value": "T129C4F13CDB674A55DE788BF33C189A5047F68198928EE7BC1DC4A1EE3D63BB49018817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441968, "uuid": "73db031b-1094-47ba-909b-fce39e4e2033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441968, "uuid": "e01acc00-5cbf-459f-9cd4-dd019ec532ac", "value": "12288:j2IoMCRPyToSdSsZrCk7GwhV24ay9NDN8w:KIAy8iSsZrl9aip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441968, "uuid": "eb0f6983-ef8d-4de8-adf3-4ded9aa646d5", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441968, "uuid": "0d1a8b61-183d-469e-867a-df7fbdcd1d13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441968, "uuid": "265c3b5a-b96d-4cc2-a614-3f6a361e657b", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238030cb-25d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633437507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437507, "uuid": "f2789286-3a91-4eb2-abda-0659839d5181", "comment": "Malware payload (Gozi)", "value": "b5beec80fca8ff136e36173187eef6f7", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437507, "uuid": "eb135d76-c7d4-4256-9462-59d75a5498bd", "comment": "Malware payload (Gozi)", "value": "e29eaf2eb064b7413755e438997bd51160816249665ba44aab2ed9b276dbfd39", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437507, "uuid": "aabb640a-017d-4551-91cd-e3dd35edf639", "comment": "Malware payload (Gozi)", "value": "5bb6942f89e16e81856c9707ed9ad979a2a9e445", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437507, "uuid": "bb9ea6f8-af9b-4c15-9e62-6b3a1f7bd41c", "comment": "Malware payload (Gozi)", "value": "76f5c336a71f8d66e58028da3614acc0c67c9194a3efa7071858b332095c5d42ac88a8408178a15fc75a2b47e881d53d", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437507, "uuid": "2fcb34d5-9a72-49a5-a76d-ec1a9e2ff9af", "value": "T1BDA3D571E1A4EBE5F824C6FDBB71F0B60AE1AC22C9928A0B35447F1674F35C569F0A05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437507, "uuid": "7d53328f-53cb-443e-a949-686a835285ce", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437507, "uuid": "9ac95b04-4009-4f58-840c-bd73b2bb57fb", "value": "768:tPDPsLsMcK/NRf4kKoMrZ3Rt5lVLP5kzMBizGjBVtoziUGerOPHWFQTB0AXmfBNz:t7ANRTMrDBVLPG+KEBfw/rOPoQS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437507, "uuid": "58463bdd-2598-4d62-9a6b-7f81ec23d223", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437507, "uuid": "6b4ec92a-543e-446b-ba5e-36398c1078ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437507, "uuid": "220ffc6f-a58d-435c-8720-26b55203c33d", "value": "Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3032b26b-25ba-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633424214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424214, "uuid": "ecbe49e6-59fb-4cae-bfef-f0126555d27c", "comment": "Malware payload (RaccoonStealer)", "value": "ebfa352b32dea95097405a3f26c153ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424214, "uuid": "b735dcda-fed7-40c5-a7b8-ad94abf074dc", "comment": "Malware payload (RaccoonStealer)", "value": "e3d5eaf8ed3418a16ad415b153f6e0dda2f71e5413a415494a270e1c0040cf96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424214, "uuid": "b6c92760-262d-4297-95c9-0d2ffd923fb9", "comment": "Malware payload (RaccoonStealer)", "value": "e2fb4032abb502dcaca52434d5abf319d4f590b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424214, "uuid": "f8b9340e-fc4a-44f7-a98d-29379dfbd2e3", "comment": "Malware payload (RaccoonStealer)", "value": "d7b17104a85443d1e29f2be1d06db757e31ecd037d06ed962ccbf3b99f2163f17c3d254394e56d425577a873196953c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424214, "uuid": "de202939-ce2e-44eb-a4d5-6098e33f72bc", "value": "T155349D10A7E0C034F2BB52FA49B59378AD3DBEB0AB3491CB56D11AEA56746D0ED30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424214, "uuid": "df82dbbb-4b20-4f0c-b862-296d55874ed7", "value": "64d7f5246a1a432e8ee086e976e37133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424214, "uuid": "c4f7ae06-7ad0-4822-a94f-410cf6d94249", "value": "6144:Z4Rw1fwBzYSfiijHhLAjPPAH7EfF0RnCADEjE:Z0W4zYsiEhLAjPYwfinHDEjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424214, "uuid": "e13bfd63-5971-4a05-97eb-01a331a9e518", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424214, "uuid": "9802841a-be70-446b-856d-8bfe6d392097", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424214, "uuid": "5fb409e9-2854-424d-8bf1-1b6a4a975028", "value": "ebfa352b32dea95097405a3f26c153ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0ba0dc-25dc-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633438860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438860, "uuid": "b6727180-831b-43a4-82cb-cf2bac80b15b", "comment": "Malware payload (RemcosRAT)", "value": "4a7d5da7fc33d422b7635fc6f608bc93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438860, "uuid": "e8ba9b92-86dc-43aa-a790-5d19ccaa741e", "comment": "Malware payload (RemcosRAT)", "value": "e4b26e2c09188228c4db16281887a17e90baaf95c7b691fa75d05af9f79ff20a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438860, "uuid": "8aed7973-e43a-4d0a-b7ec-ebc3c5139e3b", "comment": "Malware payload (RemcosRAT)", "value": "6bbe47c60623f99062f3fa47df4c7f17db51184d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633438860, "uuid": "e8ab1c12-a78e-4b22-b6f9-a76ce8b3da17", "comment": "Malware payload (RemcosRAT)", "value": "6b9533b914cad62076a49a6da35f381d08bbfcba9e51f85287f4be24b68ad82f903fc94f7775d13973a32a4f77796090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438860, "uuid": "53982798-42ca-46c2-be9d-1684b3e4a537", "value": "T110C3ADA0FC91FC47F044C7349822E5A4A6E46CE7CB058917705C76D42EBE32DA69973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438860, "uuid": "b8362b84-8596-494e-a541-114ef15d3d99", "value": "3c727df5dd5653a8cd06df0c3a130336", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438860, "uuid": "492f03aa-571f-45c8-9266-2111d75ac476", "value": "1536:gDnG6WczFRa7gPff1C/dYbZ1it01pGEFWvKYHoZz6K+/uy0FpSvZpDnFe+PQ53:WWczna7gv1WYLQoHwIZ+K+/anS3Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633438860, "uuid": "87a312f0-36cd-4d0b-805c-2dfdb796cd1e", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633438860, "uuid": "df76af89-dc6a-48b7-8140-5ae6a4a53352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633438860, "uuid": "7a517a13-57fd-4d1e-8553-95d7bd1ebace", "value": "4a7d5da7fc33d422b7635fc6f608bc93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffb53bd-25e6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633443380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443380, "uuid": "e536d9a4-f3c9-4c26-807a-30042d24b6d4", "comment": "Malware payload (RaccoonStealer)", "value": "a48f52a04c506bc0fad43183584856c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443380, "uuid": "e7b1dd19-3356-4bad-b5f7-3ea823e64068", "comment": "Malware payload (RaccoonStealer)", "value": "e5288c5a2eb9af558e48fe57edbcd830c0719427f0737be21a1c47254b1ccf00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443380, "uuid": "d83af53d-896c-4a39-81ad-9c6169d5a2ab", "comment": "Malware payload (RaccoonStealer)", "value": "9fb09ada7329572950de028f48c2a40cf7a5d7fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633443380, "uuid": "5bde62ad-96d7-41a7-af12-8fdd2aec7ca0", "comment": "Malware payload (RaccoonStealer)", "value": "b811eb9b6540c0abbfbeab0b60e05587e1fef3080b3dc8226002aa18cd012eaccd4eb35e3e7d0e78b2a8431725bc25d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443380, "uuid": "537f77b5-4190-473d-95f9-b0639e17ccad", "value": "T11E06121B73094152E0DD8535CD1BBED172F613660E42DA3A36CEAEC82B329D5F216B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443380, "uuid": "560d7d18-f2c3-43e4-8900-9c217b1a80fb", "value": "90cad7617ed30496a2afce7161731440", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443380, "uuid": "60c71b9f-4d94-4802-bdfd-3fe91c45a578", "value": "49152:ET2f0wA0d8TGNWICcwc9CtWNYjidWW8/FzzC2oOXSDglUMgUGGsJ/NkqVY5bOSid:ET4V8qPCb6cziv8/F/7iDqUvZJ/NY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633443380, "uuid": "438fcd93-f658-4c6b-941f-f8a41c0e1c08", "value": 3869696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633443380, "uuid": "8224863f-ffb1-49d3-9278-05bc2554b6a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633443380, "uuid": "420115c0-4d22-4b28-973f-51c5db72e190", "value": "a48f52a04c506bc0fad43183584856c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2677545d-25d3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633434935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434935, "uuid": "bd045a5c-3756-4dd2-83c9-8d3aeeae831c", "comment": "Malware payload (AgentTesla)", "value": "96b732aed307e56b9bae88088b863da9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434935, "uuid": "a1c7ff72-f75f-4794-a661-b12dbe0022a6", "comment": "Malware payload (AgentTesla)", "value": "e57cd18f57da68b90790071673ac21fa6bfbb9b2b54451fbe4276fc506536719", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434935, "uuid": "75d5b488-f79e-4b2c-a10c-a3814ed995e2", "comment": "Malware payload (AgentTesla)", "value": "df468f99ad3d252f1a6f62dd39279122954a5f02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633434935, "uuid": "7d1fe012-ecc1-4f50-9147-e37821899f0d", "comment": "Malware payload (AgentTesla)", "value": "3282196c8662cd1199f2529eb7e8e038eef564ce5cd2ac43acc88776df93cae2ce532fa7dbed671d2a9aba71bb105423", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434935, "uuid": "e5ac53d5-7e42-4ef1-a2e2-35f90309c87c", "value": "T154B4CF94339F6F04ED389FF8242C619153F6BC37117AD3694ED5B0E95A32B700A91AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434935, "uuid": "b7468bd1-3e6f-4909-8682-d7d8abf9fe59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434935, "uuid": "7cd6d306-3e09-4689-818b-f89076ac673a", "value": "12288:86occ0WHP0Q0aK3z/DIUamLrHk7PuG47CtE:86rc0Wv0oM/Dbr/EjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633434935, "uuid": "14aac2b2-74d7-4a60-80e9-5b8cef0929eb", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633434935, "uuid": "1c0712bc-8394-4adb-8e41-179d71e68780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633434935, "uuid": "5c288cf1-c395-4b7b-b8b1-2cbb18b9a9a2", "value": "NEW PURCHASE ORDER FOR OCTOBER 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd307477-2599-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633410304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410304, "uuid": "f693b9de-87b1-4c34-b5ee-64f361b8e8d7", "comment": "Malware payload", "value": "9ba400f5b9ffa08c4088151206c3e37c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410304, "uuid": "4dd27558-28d2-473c-9624-d4d294d8f398", "comment": "Malware payload", "value": "e5c16596f19a453542434e68227919861f5a504feed7b081589dfad0a7946325", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410304, "uuid": "698c39f7-564b-4a13-bd74-1f875c4928e7", "comment": "Malware payload", "value": "39a0e994b92bcc5268f3e243c1c5738ef9bc2b11", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633410304, "uuid": "50c83ebc-4dfe-4793-bcf3-9171e53ba3b0", "comment": "Malware payload", "value": "1f9ab8aa4df1c3675755a13734d38863916f8dec64e700b1573b24ac5da6161b4e52d314f7d7c2480148a1d1d53541b9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410304, "uuid": "29d21f97-8f87-4e78-8a1f-02c15863454d", "value": "T1E1642349AF313849CC6BECBCDE0006E645AF918A1FB5B36E68399870081E34717ADDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410304, "uuid": "ce566e1f-0d88-4362-9c74-c61e58c38905", "value": "6144:pTnuHaD8ojrjNifjBC4usZnh6VSQzsdRrRT3VAY9LxkEhJAFN7fJiFqvR:pTQaognAdC4BnhIS/dfKY/vhiFUFqvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633410304, "uuid": "fcf71c4f-ff81-4bba-b142-e529fd6b30da", "value": 308601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633410304, "uuid": "cac6c538-eb8a-4fbe-85e3-14b5787ebb8a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633410304, "uuid": "a11503f8-31b5-4511-9f2a-48b4abd7c61e", "value": "10-04-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1920bce-25fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633453261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453261, "uuid": "dca09268-d474-4763-8abc-0e07fdba6be9", "comment": "Malware payload (RedLineStealer)", "value": "2230be98a60b2f788f674d605cc79ef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453261, "uuid": "8391961d-de33-42e9-a7b7-0d9df64beeac", "comment": "Malware payload (RedLineStealer)", "value": "e649de0bee767b8eeb2c1b14cf6fa21702eabff811a0ec26b1441e715c4a0d8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453261, "uuid": "32bb8416-48a7-44dd-a23c-8a16b04245cb", "comment": "Malware payload (RedLineStealer)", "value": "89e506a877a3d344b57e1ef31c3e1063cf870766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633453261, "uuid": "d36308c6-de9c-4644-b0fb-0a1728afb979", "comment": "Malware payload (RedLineStealer)", "value": "c59744b25dc392c226e37e24db0859b80fc2b3911b63d9035656e6c739393bfb488d9804e1976bd71208a1ae57900828", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453261, "uuid": "68d5164a-4550-4ef0-a3d5-22e1e0cdb076", "value": "T10A152302B540D1BDE4D0A9B79E3CA668092CACC017115BCB96C67FDFB4B21D14BBCB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453261, "uuid": "90ab8c66-ff5c-4f7d-b176-d4dde1050748", "value": "e51ee40ae0ed0decdf850b45dd7e4ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453261, "uuid": "a1f7c6d4-4b90-42aa-a4c0-1c37d7e8028a", "value": "24576:6YMAwUfkiEeIpWn7Vm/jkwBm00JG4uJrVhMWrPa2cw:6YM4kpeIpIY/j5DmaBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633453261, "uuid": "7d845e28-5723-48b7-b1e9-d5ab90b93e36", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633453261, "uuid": "3ac99314-f42f-445a-af0c-5c88bb84840e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633453261, "uuid": "af9612ee-7164-4df5-8f2e-1b848e14646b", "value": "2230be98a60b2f788f674d605cc79ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bae823b-25a3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633414382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414382, "uuid": "15411f32-74c8-402f-abf0-98d696136c88", "comment": "Malware payload (AgentTesla)", "value": "54c39934471a53f6c55f3d756415db5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414382, "uuid": "304fce1b-a738-4ab4-ab3b-5441b07ccee0", "comment": "Malware payload (AgentTesla)", "value": "e6a574a819e0cc41ef5ccf5ddc5e7ff13fd2e4a18079ee07b63e377e6909c0c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414382, "uuid": "171ee5ef-1d2f-443b-a3b1-ee74b769edcd", "comment": "Malware payload (AgentTesla)", "value": "d081815d5314ef8f90ec583cb070d76e6b4b930f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633414382, "uuid": "01cff98a-47c1-4735-a24b-82f6c72bb37e", "comment": "Malware payload (AgentTesla)", "value": "c5036031e4fc516cec3ae7d760a98745ae8fd97c1ba69a180708a8f54aee63a30c4d4422c4a9cc20a349d33218c004ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414382, "uuid": "07aee103-d5f3-4dcc-9ccb-431ab9be4857", "value": "T153D4F13CD7534A06CE7C9BF73968A26087F6A194878EE3BC1D84A4F93D637B5952040B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414382, "uuid": "d05e8316-e27e-46a9-b3f0-9b2e131a917e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414382, "uuid": "15c5b85e-1eb2-41ce-8059-475b2dead3bb", "value": "12288:tPIoX5I97y8ccySs04x5TPIh+khUftuc7r9jEIGy9NDN8w:ZIVRRsrfTPIh+kylr9jyip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633414382, "uuid": "f56a5a37-85b7-43f7-bc08-e9f8544e72da", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633414382, "uuid": "6b52c9f7-71b5-428b-be45-af2f1392611c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633414382, "uuid": "c76ed482-b8d7-418c-a7d4-fd9a96c3daa7", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0a3ea4-25c5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633429200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429200, "uuid": "b7c763fc-6d3d-48bd-9431-38a3d95b53b1", "comment": "Malware payload (AgentTesla)", "value": "0b930a241cd92c8cca4b571fbae01c6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429200, "uuid": "83bf7e2b-54a1-46a4-a57f-d8c632c7a7b8", "comment": "Malware payload (AgentTesla)", "value": "e71689c9ec1a773f5c3c3a6051be4ce9ea02db2cc1645d8ffb5b742ae874ab37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429200, "uuid": "f3f02842-f5b6-4300-bf04-9959fc6c5a2d", "comment": "Malware payload (AgentTesla)", "value": "6ed71f6f79cd22f305f56a6bd0b46b29aa44c9fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633429200, "uuid": "e06b90e4-82e7-41e0-81a5-4185a90e4292", "comment": "Malware payload (AgentTesla)", "value": "11cc32e1233b4a208857c0a77aeaf75178b81e9cb273d83f495754ea6ec2f657a1ecd06f74c5f1d9d2e2545c17fb4bd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429200, "uuid": "6327fa41-cf9d-448a-8abb-2b784a6cdb0d", "value": "T169D4016BF7474616D8289B31EDA77B01275C8FB5E887C26734413AAD817B3AA6C003D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429200, "uuid": "2529cd4c-d167-4dae-9964-2a7e9972df34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429200, "uuid": "9bbf9b80-2b63-4cc5-8a62-53f5eabe7513", "value": "12288:U0aCHdZrEgOwQF1YsRILSrmQ4dqrBsQj1vkEedmTKAs:U0aU7r7OwcHRItxdqreivkEe4OAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633429200, "uuid": "5c8956cd-60db-4a54-bb83-73a63d7c1fe2", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633429200, "uuid": "af4ccdf9-60d5-49d6-a4c2-0eefcd2b156c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633429200, "uuid": "010937bd-1859-444b-b1b8-64351585c6a8", "value": "stubcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed84a033-25e8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633444288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444288, "uuid": "ff3b6404-7ac1-4b85-9a63-f30fa9f46ec2", "comment": "Malware payload (RaccoonStealer)", "value": "a6ca42ecfea01ad205d3a34780eb08c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444288, "uuid": "1627dac3-b837-4492-9ed5-8164d117d48a", "comment": "Malware payload (RaccoonStealer)", "value": "e777e7d65c22cc77d0b17b09c18abd32dc7f812a7d99f515167da8190cb1d2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444288, "uuid": "d8eb8da2-c6b6-42c1-9374-12eae8eb2f93", "comment": "Malware payload (RaccoonStealer)", "value": "448038b5f8a9371f7be4045f35546fbdc23a2b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633444288, "uuid": "6b244d6f-c75b-4eb8-bd73-8a9b9a53a302", "comment": "Malware payload (RaccoonStealer)", "value": "2c0f80124bba186966d4a64f12e3b08dc78b286d6a0fe5aa6cdd3e3415bda5ac2e08e2af75cfe40f3404cd1f062d8032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444288, "uuid": "716b8f68-b3a9-48fd-b5ea-8ee3c21f2f5a", "value": "T1E534AD10B7E0C034F2B712F948B58379A92DBD706B34D5CB56D51AEA9678AE0EE31343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444288, "uuid": "a09d27d8-9bf0-4bec-aabf-3d9790f38927", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444288, "uuid": "cb330266-9f46-4353-bd71-262c6f3e47e9", "value": "6144:G4AwhPQpXSC0OGCDhlw8w2nxYOKnk7Md5YMtbRe:GhiAXSC0OGylw8VYhncMd5lHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633444288, "uuid": "d03f442d-b4d3-4a3b-9437-1d52a4e3eff3", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633444288, "uuid": "12ab3804-5ff9-4425-a2a4-375b70e774e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633444288, "uuid": "64497730-3246-43fe-ae52-c7dee0e9e03d", "value": "a6ca42ecfea01ad205d3a34780eb08c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b169727f-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633437316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437316, "uuid": "c9957f5e-957d-483e-96d1-19c95807ebf4", "comment": "Malware payload (AgentTesla)", "value": "d2feeea3c09db7c63cf8d7830f1094ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437316, "uuid": "ae6ff197-05f3-4861-8473-22f7d84ee6d6", "comment": "Malware payload (AgentTesla)", "value": "e9b3196357ce726f8a5d84cb7af80d00be6e739e11a81b1f96c4b7c17db07d3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437316, "uuid": "82aa09b0-2f24-43fb-bf80-2d352c7e4f07", "comment": "Malware payload (AgentTesla)", "value": "5280a67af138694a7588e03ac57b0c7939f49a47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437316, "uuid": "fb7236cf-3a25-43e3-ad01-3de5df1f6807", "comment": "Malware payload (AgentTesla)", "value": "5391f0c6320caa1484fc848e5ed136d839066ba1935d1baf89e84c15beaac9bc6117bb405f959b19113edfdc54c7184f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437316, "uuid": "3fdd1052-8f80-4f99-9ce9-cce159bd20c9", "value": "T1DB6412133959B9DFCEEB29B5EC8896F99216CD164BEB783B408635790A3034C5733C21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437316, "uuid": "1e49c31e-c980-4666-91b8-f15b5ae2bf08", "value": "6144:4odLM+KwEl8pUuOkHRbk7ZgmOhmsM1leqAoEdHW1Y6SPmmIwaj2UxMzmNu8FNHj6:TdLMDt8ONkNKiY1IqAfHW1Y6SemO2dzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437316, "uuid": "981a8c67-05bc-4b7f-901f-bd32b10dd18f", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437316, "uuid": "044bd425-3b0c-40bf-a6bd-ef2d4c87f360", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437316, "uuid": "6ed3b0ee-b73a-4263-bbea-f18f4ae913de", "value": "PO2109-1445..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7764c0b9-25a9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633417032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417032, "uuid": "31a30624-20fd-4c83-98c0-7f313de426df", "comment": "Malware payload", "value": "3f15074fc62ddab5e2041b718d2f192b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417032, "uuid": "6a357f93-1552-4727-8673-9ea46a739050", "comment": "Malware payload", "value": "ea0c0418bfaa98b3fadbaaefab2683077d3b1f273322ca98267c12ce126cbdc3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417032, "uuid": "4f7708fc-dc19-42a4-8353-df70769a2fc5", "comment": "Malware payload", "value": "6c561fe98ac05f8d29f576cec1e0d96a6cf83e51", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417032, "uuid": "3bce1c9d-1c78-4300-8058-0c0fe4801cdf", "comment": "Malware payload", "value": "0f0f15d5bf12ac300e8c9f7d653ea63cae89bb3832b0b6cbb60c905dc32e777343fefdc809062b788520298f1022b801", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417032, "uuid": "4d8e01bd-3a53-4d8b-87e7-87f8fcb6595f", "value": "T16DE2A6437662E952D7A8D7528F987E649A7E35C992332D4CD0B42AC02C70FC3A68537F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417032, "uuid": "b0cc710f-486f-4ed4-b519-71b62af26bd3", "value": "48:oWHGM8fE5ws1slU9WP4NpQfMpsTs9OuPA5CVqX:o28fE5wKOU9WP4N6Mp4+OuPAYVqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417032, "uuid": "c0502952-2850-4257-bb52-331d1926a1fb", "value": 32111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417032, "uuid": "a550706d-324b-4892-852a-adc0eab770cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417032, "uuid": "088a8315-2acd-4edb-91d8-181e44b5164b", "value": "Bills-8182787127552.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b88ce0f-25f7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633450566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450566, "uuid": "67fae187-4b83-4840-aa2e-f2f61700d13c", "comment": "Malware payload (AgentTesla)", "value": "ed18f902ac9db5df0d922df455fd820a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450566, "uuid": "927c80e8-7bdd-4620-baa1-e491a58bbe4a", "comment": "Malware payload (AgentTesla)", "value": "ea1ac8040f307caba810a029c41a3191f1656aa9538ad25f154e4a2b668fb624", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450566, "uuid": "2a34e65e-4e6a-4a2c-9543-29f6db5ecf25", "comment": "Malware payload (AgentTesla)", "value": "039f673876ba03c678a2285e209b5b944b7ed7d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633450566, "uuid": "5b20c075-aeb5-4227-a2a2-ea3ad5c81f9b", "comment": "Malware payload (AgentTesla)", "value": "5086d4113a2b5edf520af2e957324c39c6c2e35fe589c85abb2a3786033f05276769d1371c26947e63f11925f61fab10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450566, "uuid": "7d8b5a71-42df-4c20-8d75-b07d3749a635", "value": "T1437556F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450566, "uuid": "a289a7bd-b1f0-4d09-a2f9-c1fb789e2a7a", "value": "6144:02EeEgjARUxWWVWotg+HkqAgW99EQNKU0J33DTLMKMNORrvdfG1kZABMBtSabitE:kiA7JCEqAjFenolYxy6tSa6HtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633450566, "uuid": "78c7734c-8b2a-4452-98d1-a657536d0b08", "value": 1671826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633450566, "uuid": "23dc768b-4282-4b4f-937c-c2ac9bd62309", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633450566, "uuid": "9748b803-475b-4838-b0fb-b9fe126d39c2", "value": "Quotation Request.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da869e67-25d7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633436955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436955, "uuid": "4b6bb3bc-2c5d-413f-8f98-d7b91a559b22", "comment": "Malware payload (SnakeKeylogger)", "value": "5fecf1a4a3daa212d175da305a0a6905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436955, "uuid": "4410ff88-db33-4526-8f3f-3c6230c601d2", "comment": "Malware payload (SnakeKeylogger)", "value": "eb343b528fb953371bae167ce5eca17c849edce896e7a78e968072dfab845caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436955, "uuid": "029106cc-c7b2-412a-ab97-8565eb83e176", "comment": "Malware payload (SnakeKeylogger)", "value": "0363370d74a354717877d2c7f1f9ae52693f42a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633436955, "uuid": "97f220c8-0b4a-4c6d-bdd7-53506530eae2", "comment": "Malware payload (SnakeKeylogger)", "value": "b06c3c430c7cc1f8a9f5dea87fca92369ca029ab7145c1201d18b034f853c73c2a10d3edb3282dd1ccba110d413a7992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436955, "uuid": "19087489-4cff-4d35-a4c1-abb3e6ab858c", "value": "T1DBB4E03CD7634B05CE788BF2381CA25143B669A4938EEBBC5C94B8F93D677B59520807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436955, "uuid": "7d78293f-a1cd-46c3-9394-ec4918a3279d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436955, "uuid": "bb69057a-6be5-4414-a3e2-b598cf8f5a48", "value": "12288:QgqIoUG0x1/YiZ17qVPsSYsZ6v2c2y9NDN8w:iIfFYY7qVPsmZ6vsip8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633436955, "uuid": "4aa015a0-7d2d-4e0b-9b48-2456395b7626", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633436955, "uuid": "987e49b7-2204-48f8-8451-41b3eecbe606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633436955, "uuid": "a18d9bce-5340-40e2-a952-4f52d3145b3f", "value": "PO_nG7p0x3vBNklWu8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81761bbd-2603-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633455704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455704, "uuid": "b7e35bde-4ad0-4927-a335-334efb4df365", "comment": "Malware payload (AgentTesla)", "value": "3fd37b51c1d423dc930b52af45b6ac5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455704, "uuid": "3e51ac8b-f637-43c1-a155-48fd5b19d752", "comment": "Malware payload (AgentTesla)", "value": "eb39b7952714c4a7c7fbfc68a077ef0a2dd31c24da35078da08bcfc0b1e2ff32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455704, "uuid": "75c0dab3-9822-4cea-8d93-76777ac8ddb1", "comment": "Malware payload (AgentTesla)", "value": "cff7abbb161c7a863f96cad015407630ee5583a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455704, "uuid": "e3f42ae7-edc2-414e-acd2-3ae3162afecb", "comment": "Malware payload (AgentTesla)", "value": "0e92e669d53a573f70a71fa85fe700da33a4047bd3022860e76a5fae3704806fae0e7146c2bb5652fe298ca59a404a28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455704, "uuid": "3f295b4f-830d-4c19-8e49-842d3243ddd8", "value": "T1CBB4CFA4339FAF05EE349FF4295C908153B6BC371569D7290ED5B0EE2E22BB00A51B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455704, "uuid": "4bddc586-5584-4d15-b2f1-d8bb3538190c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455704, "uuid": "af2056bd-9b93-468e-8201-24e8ba56eb34", "value": "6144:WmT4bb+Qnh+Q+3HwOcc0WLZVhmh5ovf3laGwa59IK54CE9cc8X81R67PBTijBXAN:4Hocc0WLZj5vPlnfVuvR67P1Hc7Iyxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633455704, "uuid": "61db8e26-594d-4f89-926f-23adf0691b55", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633455704, "uuid": "bb81de67-f1a6-4556-b6b4-0781345f7812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455704, "uuid": "ff5ac26c-57a8-4cbd-9944-0f592cf15ae0", "value": "3fd37b51c1d423dc930b52af45b6ac5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f6c88e-259c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633411418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411418, "uuid": "e91b6b9d-222c-44df-beef-f77df2e76ca4", "comment": "Malware payload (Formbook)", "value": "27248c212f5a76afe7b38ca3239ba1a1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411418, "uuid": "44c00989-058d-488c-9757-7f6bb796d049", "comment": "Malware payload (Formbook)", "value": "ef7dac12ff9a71ded72dde4357757c070df563935905771d2f6121204461c739", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411418, "uuid": "a58959f8-1fa9-48df-be75-ce2679d54163", "comment": "Malware payload (Formbook)", "value": "2173deb7195eda4b54887f31c735624ae295e9c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633411418, "uuid": "5f9c3ca3-d4d7-4e6f-8338-95fed6ccc6be", "comment": "Malware payload (Formbook)", "value": "0e4c84c7203975b73e11378560c4605503f899033c0c1962bd6949a8920f23e0fa4dd3cfeb2a5148cf4a4b97d6ddd38a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411418, "uuid": "7d443aed-24e6-422a-af92-1b9bd7800e1d", "value": "T11584220BA106A323E6FB27FC9417528E4036CF2ACB28805272CF7656DB75FA1C865577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411418, "uuid": "e3ba2816-4d06-441d-af92-35def7529a6c", "value": "6144:84VAz60K6n1FH3qtyoMtdxj/wnvfMMslURiVAtJWLEMWQPaHmyAWmksAaBlJJnmC:DAKwqt+t3jwvfCq0iQPqmk9aBlfgizGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633411418, "uuid": "2e339a5f-b474-47da-affe-32cd75c114db", "value": 403464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633411418, "uuid": "11d298e6-c6dd-46f2-b16a-baeba332a84a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633411418, "uuid": "72342b43-1098-405f-b17d-0a74425249f9", "value": "Tender_Specification_Bid.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a335b9cf-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633454472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "0708afb6-471a-4a29-81a9-c1646bf8f8fe", "comment": "Malware payload (RaccoonStealer)", "value": "974694fca984a57f52eae623c8825330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "d4c1f6dc-c4cd-4988-9559-0c31012fbea6", "comment": "Malware payload (RaccoonStealer)", "value": "efae6a5b69e33c6bbc406f117e2618639fc1c382e1ac1ffb179f7171a776740f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "1927c338-a6b6-4be4-86a0-3492c0258a30", "comment": "Malware payload (RaccoonStealer)", "value": "c3779ecc97e9fa179a22e9a147afbfbadd398660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454472, "uuid": "e462ce72-c1ca-4995-ae06-68c6f3f72855", "comment": "Malware payload (RaccoonStealer)", "value": "ed95133153edbc70e75de2a0341809abaa9b40ac7b33e0f5cb445b160eb6d3f0661b7192d8a33294a9762c1263b09125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "822ed76b-5f8d-416c-b20e-8e62e1656652", "value": "T199B4F100A7E0C435F0B712BA4579D3A8A53EBDB0AF2445CB22C61BDADA356E4ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "e72661da-c33b-4b5f-b5e2-d4c1db1c67f6", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "49238080-2464-4f56-ad08-f28fa087ecb3", "value": "12288:pBde64e9DQcOaJQYnoJN60JRO7nQQXg/z1vLS5uC+SR4I1WrCwLJS:k64MQGJQI0JRCQh/hjoHDtWrPLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454472, "uuid": "27625430-403c-4b01-9e31-5624170816c5", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454472, "uuid": "2f6c5051-71ed-4637-bef7-a34d1034cae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454472, "uuid": "3eaf05c1-f700-4969-8daa-f2d80d70a725", "value": "974694fca984a57f52eae623c8825330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f53a9d7-2606-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633456854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633456854, "uuid": "6aaa6833-4b36-4363-a964-903423dae494", "comment": "Malware payload (RedLineStealer)", "value": "e3412420d3686942210ce38878f2cea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633456854, "uuid": "038b09bb-1e8f-4788-9520-12105bc12ae7", "comment": "Malware payload (RedLineStealer)", "value": "f0627549d39ad1d85bcaae5cf0b5a90b885658e348480d9caeb475cfbf0d1367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633456854, "uuid": "5637fb61-82f0-4f1d-a006-6cd5772ec09b", "comment": "Malware payload (RedLineStealer)", "value": "0fb171944947872ca13d00195cae6242a22b23b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633456854, "uuid": "82e45298-a649-459e-9765-fadd2ad75986", "comment": "Malware payload (RedLineStealer)", "value": "4889ddb0855bad8f5f4b4e53ce5e107a403f294341d453d1845eb42c34a2b3fc9cb5383b54ba39d927465b2e90509fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633456854, "uuid": "def37241-1414-4ae1-8118-defbffaf1c39", "value": "T18F263370100FE1DEE94AC9B13F2FB8EA35E8BA77133587561B4D4745A4846820B3BDE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633456854, "uuid": "639326a7-2f94-4b6b-8311-d74850ad8fb3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633456854, "uuid": "78609a26-2361-464b-a4c6-8417ab826030", "value": "98304:ydShRa+ZvnPWhK20RTyC2mvrhilFUYBBGOqtrMS28XOz4:ydwRa+ZvnPz2aTyC2mThiDFBTek4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633456854, "uuid": "c69d6c0b-2cd1-4ece-bb87-f691b94d4b26", "value": 4803441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633456854, "uuid": "8de492b3-c67e-4310-b4b7-9429065309ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633456854, "uuid": "7232e72c-84f7-4a4f-8bbf-e2a1929a5780", "value": "F0627549D39AD1D85BCAAE5CF0B5A90B885658E348480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36a9294-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633454499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454499, "uuid": "740505b9-5669-492c-a8be-97cc925b069a", "comment": "Malware payload (AgentTesla)", "value": "f4761c452e64c83b3f7c164b0e4d7691", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454499, "uuid": "99b508b2-e8d3-4bd0-a3fe-3e0605ec5368", "comment": "Malware payload (AgentTesla)", "value": "f06627f772053390f4b66021128ac0c2c1c2be48db2acf9a265d435bcfe0aaa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454499, "uuid": "6c435fab-5c40-4e13-bce4-642bc227fe08", "comment": "Malware payload (AgentTesla)", "value": "0202a4f22b40994897162426849fafc380b8336e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454499, "uuid": "d124d130-c028-405a-bc02-b32cd9ec7867", "comment": "Malware payload (AgentTesla)", "value": "e6fe8fe5bb1a1be99d92c267fb195cb4593eac59ca602904e53a1cf168400f3f9e235d434ac1ee66d9f3498f00c3a7dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454499, "uuid": "bc889847-46da-439d-87eb-d72aab6945ff", "value": "T1B3B4DFA433AF6F49ED385FF4146CA1D253BA7C3B106AD3290ED5B0E95A31BB00E51A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454499, "uuid": "919be658-b898-44a0-9037-ea7b4218c96a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454499, "uuid": "ac5f5644-84f3-43d1-a6c1-4ae3390e90ec", "value": "12288:Scocc0Wy7DgtQBFPJFwVWma1x9JsAso7mkJbNqTK:Scrc0WyHBFhC4HH32kJbYTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454499, "uuid": "e4cedf3d-8f1e-45b0-9ad0-937c6afbb542", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454499, "uuid": "07808b2e-7291-4a6d-b1ff-00b9a798f55d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454499, "uuid": "74a1bf5c-4693-469d-8bb6-861c8bc4bc6d", "value": "f4761c452e64c83b3f7c164b0e4d7691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad045292-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633440744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440744, "uuid": "1677084e-171b-421a-a4c2-d5d4f6190b9d", "comment": "Malware payload (AgentTesla)", "value": "981b8d98046059144e9ec257ee60d4f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440744, "uuid": "16a9efbf-5463-45b1-8732-8cf85220dbc3", "comment": "Malware payload (AgentTesla)", "value": "f2e88accdfb4e261b62c6e438e4104e0968866e2cc8045b712698e73185ed6d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440744, "uuid": "ff3d984c-23b1-4f6d-b8a9-da103fb527c1", "comment": "Malware payload (AgentTesla)", "value": "2a3c3613184404a7a0b4253878ca76740089d1c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440744, "uuid": "fc641430-a83c-4fa7-b02e-bfc0e18bba2d", "comment": "Malware payload (AgentTesla)", "value": "d8d37271df54cdfad8203fa85fce99a728d4fbce2ec26a869c1e7fb7f5076ac67de76dc12a84ddd7663e289d42ce84d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440744, "uuid": "0ba52380-5cf9-4d85-82b9-605b27f54271", "value": "T18AD4C29B7E83E58DECD2857D49FC1C22BF12E8A6020E4FC340D773AD5988956FA60563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440744, "uuid": "02e29c60-afd9-4e8e-bd24-3e11619e7253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440744, "uuid": "71c0e74f-1d0a-42e2-a332-8cc6af083764", "value": "12288:rLIiOOo0DMvBnlxWXhN6mWKKy5blPJL+cOo0X:fIPOo0amhNGhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440744, "uuid": "0964a263-fc52-4c75-a8ee-5aff8d13705e", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440744, "uuid": "18e903ba-64b6-4c85-985a-b158f38c6747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440744, "uuid": "03bede2b-0aa1-466a-b992-3f098f9935d0", "value": "Inq List.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d31c5fc-261c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633466300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466300, "uuid": "e6cd6735-b042-4c74-89b3-f5e2cc843887", "comment": "Malware payload", "value": "cd51f54c69fdc0253f8db0f98a574dbe", "object_relation": "md5", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466300, "uuid": "76353189-7100-4526-9c5d-8d011d2a665d", "comment": "Malware payload", "value": "f428b4d0673ae67472fbe212086e70eeb5b6876e80a74b59ff8ba3e6def5e9b1", "object_relation": "sha256", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466300, "uuid": "5cc2026b-9575-4923-a3b6-5456d3455e34", "comment": "Malware payload", "value": "ee5f3daa03e34cf4d44c7f56afee44bb0705d32c", "object_relation": "sha1", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633466300, "uuid": "1c63e645-2802-45ce-8bd9-d4c390d060b3", "comment": "Malware payload", "value": "391aedca3b2f5390a6d2656ae27838dca133260aa2cc8dc4ed8923672264285b90718040d665d683df6866d772d887ff", "object_relation": "sha3-384", "Tag": [ { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "ESPecter", "colour": "#92E535", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466300, "uuid": "96d2d990-9686-4087-b1e3-97c312d73502", "value": "T15843C0C78F383677DF970E31D4DBA2B15A36F4306F6681EB752BCBE80992314209416A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466300, "uuid": "460710fb-124c-468d-9516-fed6654d9ef0", "value": "b9cd9f330c63bf88f4256d6a13e4217d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466300, "uuid": "9b400e81-cd89-48e4-9b9c-577f1011ccda", "value": "768:sUKF67a9wsT4KJjjO4xbr+3z9KMwwaETFQN7J+9OdstfXFVDgkyIIL7HLdJ:X/7a9ws/OO23zFTKshBjck+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633466300, "uuid": "d6d52fc8-aff6-4721-958b-d7115d0859df", "value": 58656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633466300, "uuid": "61f98258-4a74-4a09-8648-bfb3af96a4ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633466300, "uuid": "32677d13-9b3e-482c-8c73-15b70d4a97d3", "value": "f428b4d0673ae67472fbe212086e70eeb5b6876e80a74b59ff8ba3e6def5e9b1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43228fb9-25a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633413079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413079, "uuid": "3a92347b-1dc8-40c7-9a0f-4920890a0543", "comment": "Malware payload", "value": "b81e11b4bf92094131205049e2976c70", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413079, "uuid": "32ce7581-9184-45e1-b985-f200c38a55d0", "comment": "Malware payload", "value": "f4b0d79748f50d34c806cd745237cea6c637bf030580bfb469848b353c13fb46", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413079, "uuid": "b00bc971-68df-4b6a-88e6-f6f4a8c45310", "comment": "Malware payload", "value": "777bba6e3cbc52f9f1bd33c615d7da968cbbb2f9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633413079, "uuid": "f78ad90e-8059-43e0-9427-a842098b505d", "comment": "Malware payload", "value": "5de649e755458134c854df8f5ea11c16d458b4c87386039bc3be6ccff4a13d77bfcd9e9f8823d35e3f9d398b633977ad", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413079, "uuid": "1219cefe-3af5-4dca-b84a-0d45c2e5e72b", "value": "T13A2523D544BB48B5EC2113712916397403B766D30BEBD18F22A3EB55128F0539FBB88B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413079, "uuid": "37f3ea38-72b1-41e8-b87b-97b96e2f1612", "value": "24576:mQIkDOV0uc3rygSp00E1jvdWqwbTlWFo6:VIwD5+gLPdwkFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633413079, "uuid": "a518a37a-d2f6-4a2a-9a9c-fda4ae3d7084", "value": 981542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633413079, "uuid": "b497da39-672d-46a0-9772-f5bc2a9b2abb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633413079, "uuid": "2bc94a42-943b-4c29-8dd7-ac3f2d91044e", "value": "PO 9K10012021FP001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23ec882-25e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633441182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441182, "uuid": "3afa8ddc-f967-4f01-98ec-db0e7e8b4a01", "comment": "Malware payload (AgentTesla)", "value": "24b816c5b996c1e58530c8ae121b8abe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441182, "uuid": "3c25b0de-f10b-4c07-954d-881053c22757", "comment": "Malware payload (AgentTesla)", "value": "f5266f5801c737ffc0372b509f77b8a14da5101a1bc667c03acd59769a400f8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441182, "uuid": "42824e96-ed4f-49d8-ac2e-381a78a9b1d2", "comment": "Malware payload (AgentTesla)", "value": "df5c48840419f728996126e9f6b4311b772020cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633441182, "uuid": "515a8684-caee-490d-95dd-54acc0b08707", "comment": "Malware payload (AgentTesla)", "value": "956aa028025a47dce2d32a58efbc286286b0ca18ec6412458df622b78c5d462b5e2da1e6f6aaa3f084424ac7ddff94ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441182, "uuid": "e8f1122e-149c-44c2-9eaf-6abddef124db", "value": "T1A3C4CFA8325F6B06DD348FF4142CA19157F6AC371579D3692EDDB0EE2B22B700A60B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441182, "uuid": "bfd5bbfe-2b0f-4eb2-a343-4584fedb29df", "value": "12288:g92j5occ0WI27Ji+3hE9g+gtts/36QPbQLi:h5rc0WIiJr6LDKQTMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633441182, "uuid": "c238d5e5-8100-4acf-8d82-e9b77762ef05", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633441182, "uuid": "b78b8c4b-8fe7-43a5-9c04-ce103e79b0ac", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633441182, "uuid": "da3351e7-dd99-4e6f-bfc2-4db250d98776", "value": "2021-09-30_TF210437_00037.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f90547-25b4-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633421783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421783, "uuid": "feaac7bf-b672-45f0-8d1b-bd1d93342896", "comment": "Malware payload (TrickBot)", "value": "b14dd93fd45b731b228ee4715085cbc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421783, "uuid": "07c8d6c0-f60a-4c8c-ac4f-942e12cad09f", "comment": "Malware payload (TrickBot)", "value": "f5b2a9d72565eee864ecd613e63882d5c12145dd71a85f44ca451cbea110ce18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421783, "uuid": "6d0bef0f-be8d-4713-8083-08593c63556d", "comment": "Malware payload (TrickBot)", "value": "d903ed9cc476b50e21bfe6dcf392c589235ea075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633421783, "uuid": "cde568fb-46ca-4fd6-b1c2-0446e112b519", "comment": "Malware payload (TrickBot)", "value": "f6dccb4621903571dfff5d4477b8f8247f2dcd7057c8d1cc7001d84082a5cbde40fb783b8c42a3677437b7cb02ce97dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421783, "uuid": "0e42e85d-5c66-4594-afab-2a8ec80f423a", "value": "T114B4F10277D584B3DA62643209EAA77AB774BD554A32CF87A354FF0CDC31240993B36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421783, "uuid": "b67eac67-aefe-41b0-8276-bcdf2b815853", "value": "e38afb91bac491f7825e4d9386ac015b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421783, "uuid": "0077ef8a-debf-4364-a68d-e5bbd86a5f84", "value": "12288:J1YWEJFGqCu7+K+1A8uKQfL/g8g54yXsJ/20V/YnOcy:J1YWEJFGqd7++bgNtsJ/5i5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633421783, "uuid": "f665f4b9-db06-41b2-85b9-ad513f758db7", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633421783, "uuid": "27f92dd6-3756-4c3f-8500-41566db4c396", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633421783, "uuid": "46d8ceac-31ca-4336-af29-3f05e9d50c32", "value": "b14dd93fd45b731b228ee4715085cbc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23111516-25c8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633430205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430205, "uuid": "dd78e21a-fe95-43b6-9435-784f310bc903", "comment": "Malware payload", "value": "a023692ebae002108bf97a14eec27747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430205, "uuid": "70ec5e52-c471-4fa8-b56f-f4bf6a7c4867", "comment": "Malware payload", "value": "f64bb8f75b426b25754cb059e2d42e08fd4db8261f967c95c2e6cfa5683940f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430205, "uuid": "5a6af13e-80f6-43ab-b446-140e50546adb", "comment": "Malware payload", "value": "7a4dd7937bd478b64d29506c191054cfead2d104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633430205, "uuid": "9a304619-8511-4e30-97a1-ae16adae45d3", "comment": "Malware payload", "value": "a5d63fae4229e2e848a62f1f626c993b53285b4ae7b15419ded8541560c6dd9c8474731a2e2678e0c25620ef723e92e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430205, "uuid": "91c69f4d-249e-4fd7-af19-daf1fd4bde01", "value": "T1C904BF42729CE96AD56502F91463C1B85775EC0A2C43CA6E35D9BF9FBFF2700CA420E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430205, "uuid": "443d87d9-b636-4195-8ace-c3e302a170bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430205, "uuid": "eb77268e-f2c5-4f25-b9ab-009294cd2e06", "value": "3072:pQAzGiEo9JdZ5rvvM3c1WGMYITGyDdqY:rEo955rvvMMgGMYARq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633430205, "uuid": "02e322ae-cf57-43cc-8e58-9fee908d26d6", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633430205, "uuid": "c6d5d402-bdc5-4fa3-9d07-7135dfaed47a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633430205, "uuid": "a895aed8-e039-42d8-9990-8f60308c4255", "value": "f64bb8f75b426b25754cb059e2d42e08fd4db8261f967c95c2e6cfa5683940f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876f58c1-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633454425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454425, "uuid": "a73369d6-435c-48fe-b83f-e99f3668a9ff", "comment": "Malware payload (AgentTesla)", "value": "ae8a8e9cad85c3216fdcd4d221b0112c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454425, "uuid": "bcea3f55-c8a2-4bcc-a09b-7019e155d430", "comment": "Malware payload (AgentTesla)", "value": "f663110aed2d5fdecf27fba39beabc90e72397d4fd661f381d1767aac3cf4438", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454425, "uuid": "ae1d01e8-10cc-48a6-80ea-aa39211b888b", "comment": "Malware payload (AgentTesla)", "value": "11045785f8a0b833ad16efcbe4008b476be02b65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454425, "uuid": "ef4d9111-27ca-414e-9497-afa3850ce55c", "comment": "Malware payload (AgentTesla)", "value": "1b4a2642db171dd844f383b6c88f7e583e45aba897bb63bbe3a2badbbb29dcd1ed52165936c501ea7a2b44ee1375f473", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454425, "uuid": "2cd53ce4-a271-4254-ba4f-39640cfe28a6", "value": "T11FB4DFA433AF6B45ED349FF4142CA19143FAAC7B51B9D3290ED1B0E92D22B700E90B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454425, "uuid": "4faf6727-08f7-4fc2-bb3e-2cc76d6630a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454425, "uuid": "d143c153-2b5a-4b2e-a782-b8fd67eeb438", "value": "12288:9m9occ0WTB7mY0a0H+Z8vdgTleoNWJs0:k9rc0WF0a0H+ZYoNWJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454425, "uuid": "badb2508-2e17-48fb-aa83-e51cd909adad", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454425, "uuid": "2d7fd289-e759-4697-bc0c-0a99d235f9a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454425, "uuid": "ef6c40d2-6975-4de2-8f8d-83fe4a40ad31", "value": "ae8a8e9cad85c3216fdcd4d221b0112c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2fb7b3-25bc-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633425091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425091, "uuid": "59c4697e-36e8-432c-b35d-63e048fe473c", "comment": "Malware payload (Gozi)", "value": "48faf019fec69d9d4c5c1fd087bf42bb", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425091, "uuid": "f36fbac9-56fe-49cf-bbab-787271504e7e", "comment": "Malware payload (Gozi)", "value": "f68b7fa37be0ae601a95fb0369757160464b595af8b1f49b4f46eb3bb7a37e45", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425091, "uuid": "0ff180f0-deae-4f18-9bc4-7458d651ff91", "comment": "Malware payload (Gozi)", "value": "fad47bf3d28874b86ef9fc3ca3f73e19b445e6a1", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633425091, "uuid": "bfc3b088-16fd-4a65-a0ed-3501e3c108ee", "comment": "Malware payload (Gozi)", "value": "f8581e3da6cdebe9c10ce1c4e936b851baebec7e1968c55e0951a9b84af037bb37f1005ee1bdeb5e0fabd2a05f3f9560", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425091, "uuid": "92c2778d-8fcf-489e-8a68-653697771db3", "value": "T18445DD543A54F510EBA96972CF6AC5F907057D09EFF1B49B78E03E0F2AAE8A3D512301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425091, "uuid": "9ae38e3d-9b32-4c20-afb6-39b1ebd724e0", "value": "3914a19d88280b08f06c9e1ef6320e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425091, "uuid": "cc19f29d-8117-4899-8b83-58572ffb7718", "value": "24576:YQW57MQhrgc/IQA3DEEf3cFDZYbZy8zl2ws5KHGv/ChfHOtpfdwuPiHT8XYAT/az:FCHrgc/IQA3oEvcFtYbZy8zl2wLHGv/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633425091, "uuid": "785ee829-dd57-4878-b67e-048c2e0cdbc1", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633425091, "uuid": "af890769-daf4-4912-8f51-baca5aa1b962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633425091, "uuid": "459ee20c-de42-4b3e-8e5e-d2eb64240f08", "value": "615c1688eba62_pdf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6313e61-2602-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633455416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455416, "uuid": "e73a6ebd-77bb-4258-a340-e61432391c2b", "comment": "Malware payload", "value": "01bd4206c38b1a2cc925c10ea78f3be7", "object_relation": "md5", "Tag": [ { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455416, "uuid": "8a2c8470-a5eb-47f0-a389-024256b0878d", "comment": "Malware payload", "value": "f6f2874755794840dc06a660603c78d4b4a294099719ff86f9e3c1af3e713172", "object_relation": "sha256", "Tag": [ { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455416, "uuid": "717251c7-f736-4eec-a0fc-f342127db048", "comment": "Malware payload", "value": "fd941083abcd7392f1071f035293cacca02f3b03", "object_relation": "sha1", "Tag": [ { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633455416, "uuid": "bf2dd8df-5f74-4999-a2e6-c222427e3893", "comment": "Malware payload", "value": "4a57ac2fa22f4ccd9d789548379ebec2e67b974a87d80b876db57b8fc8fe0d09c3f9c8db1ab8bd3f7d9d18950880e139", "object_relation": "sha3-384", "Tag": [ { "name": "kix", "colour": "#7612B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455416, "uuid": "1454f500-0b6e-42b1-bfc8-508ba7d08511", "value": "T146D095FD5111715382416D663067315F855719C5D27312E829713353D65951450F16E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455416, "uuid": "1ec68957-e4e7-4f77-b20b-27c5b43e17c8", "value": "6:g/8JWK7DOgUOkcZ2UB85hlR1cSfXPJjS85TyE/8vMRJ1Un:g/2/ObcAUBgFjf+E/WMv1Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633455416, "uuid": "8eb92d27-ca8c-44f8-a6fc-f10ea44dba3f", "value": 261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633455416, "uuid": "9090c217-4a8d-451c-a369-23dd831fdfb0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633455416, "uuid": "acfe3fcd-d484-49ca-abd1-e8c3431c53cd", "value": "arab.kix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f21f10-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633412337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412337, "uuid": "3778f292-e61e-4a1b-b979-b91e9c545984", "comment": "Malware payload (AsyncRAT)", "value": "aa4f46e132510172e5beb140a7f03957", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412337, "uuid": "d4b2d357-dfdc-4284-88c0-5ed3569ba3e6", "comment": "Malware payload (AsyncRAT)", "value": "f7daabadaa1974b529e8db367a07d128b60724cc54c4dfcc008c35c124b77929", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412337, "uuid": "8f89d396-4eb6-4083-8396-08c7d7688367", "comment": "Malware payload (AsyncRAT)", "value": "2f6e2b495a79bdfe69b8ef0ecb3dd656d2d348a9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412337, "uuid": "d43b7580-4c17-4295-b9c3-a62663035de9", "comment": "Malware payload (AsyncRAT)", "value": "aa7a9ddde41d4097b95a1a6527008c06fc430b37f0e2a2084d722caaadbf4c7cb17a7e61cd903d61c6e6e455563a9606", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412337, "uuid": "e9a1b9f3-1016-4f24-b822-6ab80e3abd41", "value": "T1AE157E657389FA92E81D0E7ADC13014243E0CA671B32F67B24D93AD60D25BCF9B5F1A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412337, "uuid": "44527a9d-631d-4254-a03d-b8a410425702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412337, "uuid": "e3742b1a-b1ab-4ed6-bd1f-4432a5aa1074", "value": "12288:sqVBfutELrDrgBL010PCLzoH3i2iNHc1MwJ7D7OYyZUVwaCzCUh3p:DxvLnrgw0M1Vcn5OY7sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412337, "uuid": "eeafcc0e-b0eb-45da-8223-a9ca01b0343c", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412337, "uuid": "677382bc-65c1-453c-b863-f9781bfdbc4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412337, "uuid": "304d7bf7-f1d7-478a-a52f-ee302c6eb1a9", "value": "LOI-20210510473689004882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263a121-25aa-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633417426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417426, "uuid": "eaeed093-d2a4-4e06-82ec-10901af13ee5", "comment": "Malware payload (Formbook)", "value": "f51da2ac8cdfc1ff41921f0fceee4514", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417426, "uuid": "646c6d9f-9fd4-473d-9f40-12273c0a6551", "comment": "Malware payload (Formbook)", "value": "f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417426, "uuid": "d05e3d4c-dc44-4fc1-ad1a-56ef363a7c7b", "comment": "Malware payload (Formbook)", "value": "f910ed6637480ff6930df72d9258029641a186ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633417426, "uuid": "119402d9-e361-4285-bae1-04fa5a6a905d", "comment": "Malware payload (Formbook)", "value": "793ae50da1cd2b9d82b0ff43e7288d45392fa97b7bacc0d9722ccf9fff415e7f20058be35603e538c2448ee1138cf996", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417426, "uuid": "be74c1d6-d865-46fb-aa42-26ec09238ca6", "value": "T107A42208A994CCFBD5A207748D76C2BBF2B99D480D915A83B790BF2F3D3469A8714317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417426, "uuid": "b47e52f5-6cc7-464e-9a68-ef52650defd0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417426, "uuid": "d92bdd68-4600-48c8-8087-f223553d20dd", "value": "6144:A8LxB6aF6vedt/reTPFRpgSdtk+rPYQUJeOiAzsSmIAIjn8PORYHlNTeYr:yW6wRru/pgnwPAJ5FwSiPVFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633417426, "uuid": "c1940fa9-d11d-4c99-bcb1-21a557bb62ce", "value": 450640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633417426, "uuid": "96bd9ac1-8786-4005-bb98-fec71b0102e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633417426, "uuid": "c1cdd154-64a1-40f2-9f7a-5194bcfb6e69", "value": "f51da2ac8cdfc1ff41921f0fceee4514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d702fa-25e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633440804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440804, "uuid": "024f9200-2dbf-4fde-8199-c38e56e4d6ff", "comment": "Malware payload (AgentTesla)", "value": "daef8c93c556a191ac649c717015e7c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440804, "uuid": "0169b254-ba85-414d-9499-fa95c8469128", "comment": "Malware payload (AgentTesla)", "value": "fbd1cc6a4525f2f98fc3cb5f10e0c070a3532deb96e3765afb9a777b12efc305", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440804, "uuid": "7cc3f3c1-bf03-497c-997f-1ebde0e00ec2", "comment": "Malware payload (AgentTesla)", "value": "69b80e0959a42b3cb094c32bf00757eab6f46420", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440804, "uuid": "9225c2bf-6c12-4afa-a914-7752f22a3ef8", "comment": "Malware payload (AgentTesla)", "value": "3272351af9f11190d949d771b090b8cbcac5fdebe745904e7a2b5e2d52637d48f367fae126965e5d1844f12fbea3f62a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440804, "uuid": "de11edf4-ae3c-4f1b-a395-963516a4c1b5", "value": "T14DC48CAC765371DECC57C1B6DD686C60AB203CB7530B8213901761ADAE2D9A7DFA40E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440804, "uuid": "0086b9f9-a4e7-4bab-8906-ef7476850bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440804, "uuid": "3c99e86d-1a15-45d5-bbad-7c576f2ad877", "value": "12288:SKoKw/wal6uhVtKqqb8zOsf/lbd+IPr8VhDtYbo0:Ssw/zPhDJqb8zOmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440804, "uuid": "44e28385-8ec8-42f2-a6f4-8b5ee3f3b6ed", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440804, "uuid": "d4fe55d4-2fd8-44ac-a239-e31c495655d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440804, "uuid": "ba170922-e9f9-4ada-82d3-ad083529518b", "value": "Kharameh2_package-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf2fdae-259d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633412072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412072, "uuid": "8f2f555c-c923-487c-bc72-369aac84a2b5", "comment": "Malware payload (AgentTesla)", "value": "0936b1f1f252163807525a555a1fb6ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412072, "uuid": "753126d6-9788-402a-bd6e-b7197d21ab54", "comment": "Malware payload (AgentTesla)", "value": "fcf650281583d3011db41649ec0726d04e35b1a99d048e1e05728f116285c67a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412072, "uuid": "2a81c7fb-217f-469c-95df-9de4825e2e74", "comment": "Malware payload (AgentTesla)", "value": "1fab173b40199e0b55804968ea3c62b53a159bae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412072, "uuid": "43e54205-0506-429f-ae4b-1ccf77a151c9", "comment": "Malware payload (AgentTesla)", "value": "d343c62d437c6564a53ae7206199f4f6bef0f9632bfc88e87013758ec6606b5b35b66b3f0aeb7bf192e94ecec0470324", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412072, "uuid": "e9abb20d-d815-4649-8203-18c28f780db8", "value": "T16394017863A76314DDB987F43C20E68117B1A53A045EC33C6E99E4ED3E63BB45AD0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412072, "uuid": "4d0d8aef-c93a-4689-a885-97059aa8a672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412072, "uuid": "4730b948-6e34-49d5-af60-e4efbcc8997a", "value": "12288:IESolzhRSObELAlOfIGe0mj8meZQns+/y9/Wqzc4+7:IESk8ObQLfIP1gm4Gy9BIh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412072, "uuid": "230401d6-45c6-483d-b08d-667eadd43192", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412072, "uuid": "5c9a3edd-6cac-4117-b795-19b24dd3280b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412072, "uuid": "f4359e44-0d5f-4d7c-9bd5-23f580194fb2", "value": "IMAGE1001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2b83f8-25d8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633437094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437094, "uuid": "8fedd5df-7465-4c72-b1d6-89527912579e", "comment": "Malware payload (RaccoonStealer)", "value": "d6ae3b83d1a5beb2d679d9527941d873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437094, "uuid": "96f6d5e9-ed18-43a4-b783-73d24fb39553", "comment": "Malware payload (RaccoonStealer)", "value": "fd8ff5a82974a95a3579b4d4663efe15c450f09f1a3d537b3ea0af91ae3c1ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437094, "uuid": "ec615283-347a-47b6-bb01-31515b4abbfd", "comment": "Malware payload (RaccoonStealer)", "value": "2a38f703f6e6f7a71d9969f05181cd4d4137aa96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633437094, "uuid": "84be1508-b80e-4c26-911e-df0644096858", "comment": "Malware payload (RaccoonStealer)", "value": "6051f93cac69737f3260cf80a17fe520c769de6c0892dacbb671853d0a77d100a18af715232a1d33524947461b125fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437094, "uuid": "5a1c6d09-f7bb-4148-9753-6c15a667001e", "value": "T1F534AF10B7E0C034F1B752FA49B5A3B9A92DBDB0A73495CB56D12AFA56786E0DC30343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437094, "uuid": "84eb9a33-7587-499d-a8b4-9cccdf6b2e2e", "value": "dd19d1f0ffda5384bb572fd4e5082d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437094, "uuid": "ea0a3692-ce0c-409e-b124-8a587ccf411c", "value": "6144:J4pg1PQpug3aO7SDg1wknNVoYzxH690lE:JYWAug3aO7v1wkNiY1HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633437094, "uuid": "15f8354b-e10c-4ad6-a101-5f8b31855480", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633437094, "uuid": "95161581-e4ab-4391-8399-54ebfe0a1435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633437094, "uuid": "a743548c-e514-48f8-8917-ccb62aa21c80", "value": "d6ae3b83d1a5beb2d679d9527941d873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a3d281-259e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633412117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412117, "uuid": "2f53f5db-b31c-4ec0-ba91-d9e1ac5b0452", "comment": "Malware payload (AgentTesla)", "value": "5fde25122e741d003219a93eb66d357f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412117, "uuid": "aa0b4a3f-4bc5-4327-b868-cc2684a6bffe", "comment": "Malware payload (AgentTesla)", "value": "fe25c3089f208c115146259347cb035fa4fe898de213dec78f0bc0f58b73275c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412117, "uuid": "f0ff7070-3e24-48a3-a046-d19ee285ead2", "comment": "Malware payload (AgentTesla)", "value": "c77d66489b42fd4cd0fdcd5d6fdfa8833dec5b80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633412117, "uuid": "637c2566-9f14-4818-b3df-86bbbc118f70", "comment": "Malware payload (AgentTesla)", "value": "5e43f809a91d8e69e9236d119554be383d71d453715a61dd4444a83df719b84034d5f27b7bb4163b7dd2822d770d3dc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412117, "uuid": "8b3338db-dfda-4cbc-a12a-486ecccf156a", "value": "T13AE423F9681C84B9C0E81CC6DF2324C8A3D190ED616B4397E963FF39911277E53A62E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412117, "uuid": "f5497e18-27fa-46cc-8912-8c496bd932e8", "value": "12288:3rqvhzFMpiWsyS/O/USoOOYpGWdRohpx5UWjCKDPnP38B1SV0u:3rqvIpVsyqOiOOYjo/nRjPMTDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633412117, "uuid": "ed095f6e-990d-46d3-a3cd-74d8b86c7905", "value": 705265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633412117, "uuid": "7aa1c9c0-1e3e-4cb9-afb9-8bf3b0b4b67b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633412117, "uuid": "5ee95e29-d4a7-49ad-800f-4b6035b8889c", "value": "PO 9K10012021FP001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c95a7fa-2600-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633454407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454407, "uuid": "2b7484de-99fb-4525-beba-697e350e55d4", "comment": "Malware payload (ArkeiStealer)", "value": "e3743ff7b888874f00381d0f86ec1785", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454407, "uuid": "d3d8a3dd-58c0-49e2-a87e-37b28dacacd2", "comment": "Malware payload (ArkeiStealer)", "value": "fe7f352d558ba1ed571223801f1cedaff170819528bef1a9c49ae20fd90c75eb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454407, "uuid": "9960a948-be8e-432e-83b9-7807ede4b098", "comment": "Malware payload (ArkeiStealer)", "value": "5ae9e0b87f91e260d412ed9590850b82eb9e4a2c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633454407, "uuid": "0245e17a-9293-4a0d-a270-733683cd1f9c", "comment": "Malware payload (ArkeiStealer)", "value": "44f11ea9ae04ff303cbee43f2d26df1caa512426bc0d5959a260edbc8cb38fda4c15606907f59a5902e1a8333baafc9c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454407, "uuid": "6ae00209-e8cf-4759-8f81-231572532616", "value": "T182E40120B6F0C035E0B752FB497993B8AA2D79B06B3451CB62C217DA8A757E4ED30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454407, "uuid": "b1d9f4ed-d448-46b0-b603-62021ce3c941", "value": "f04f32f42fdfa69095db11dda219012b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454407, "uuid": "a39a650c-a721-4de5-b392-577a1a1cb27a", "value": "12288:rEFw6WMrst0lrgZYa+6DGJzTpkdzyUL3M5XAMCjLnUXZSuFmPLirIQwEMNKD/:T6WMi0OZYamBFCFAHMLebsLiMQYo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633454407, "uuid": "6babd8db-67ee-499f-9537-fe7de430b512", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633454407, "uuid": "c6633f7b-0b6e-491e-9aa4-99a0985f80d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633454407, "uuid": "127a09c0-54fb-46a1-935a-7bf183766df7", "value": "e3743ff7b888874f00381d0f86ec1785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2622992c-25df-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633440088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440088, "uuid": "5a458681-3067-4a32-a9e1-f2cfb345fc52", "comment": "Malware payload (AgentTesla)", "value": "3da3ed8b0ffc7e65d27985cb744d2e81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440088, "uuid": "0c56dd92-1dc2-4190-974e-978714c3f502", "comment": "Malware payload (AgentTesla)", "value": "fe8b552d0266feb1b3ef94bb39209fc1253295865d8f49a2f6cb6a3f68271c7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440088, "uuid": "2a92bd40-aac3-493f-8071-8b3c4c24d35a", "comment": "Malware payload (AgentTesla)", "value": "adfec0b63f267d3891ef085a69b78cc46951c909", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633440088, "uuid": "d77873b3-bd33-4c54-8370-c76668f032fb", "comment": "Malware payload (AgentTesla)", "value": "1a222aeed3e9d029c5b31eda6428684f3deeccc37708cbadb19e148505b9984fc96a85c94380cfabcbc9b8f3dffff9ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440088, "uuid": "5e24b332-c39d-468f-9ef0-fd39050494d6", "value": "T1EAF4DF64B747DA07CE754BF028ADA740137AAE110649C31E3885B7BD2E73B74264CEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440088, "uuid": "f1f14c1f-63b3-4718-9474-ad50eace0ccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440088, "uuid": "c4cadb1f-1d18-4d6a-aa31-776881d2fb7b", "value": "6144:YgPWOQ+3HwOExxjb6x+gZbfHsD1c4ZKkvSp0SWZd8ck73k03+stJQfp32Htz+owD:ioQbB2HsphvSpEXFk7Isa2NDw1wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633440088, "uuid": "cc37e281-e826-4331-938b-503bd64302a6", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633440088, "uuid": "96f4753b-5928-4236-87e3-15058bbc1fb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633440088, "uuid": "53068414-b1a9-4fef-80c0-d05a937fcb91", "value": "3da3ed8b0ffc7e65d27985cb744d2e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7207675a-25bb-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633424754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424754, "uuid": "445643c6-be3f-4758-8aa8-e9b3f100fbe7", "comment": "Malware payload (Gozi)", "value": "1fe42a1e3803c0080a8377531a556dca", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424754, "uuid": "2d656590-b01e-4468-a562-952db3af933c", "comment": "Malware payload (Gozi)", "value": "fed0ceb220d653d828440b9858d7cddce0a38afaf368f3dede8c1a9942a9cfac", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424754, "uuid": "53751456-cc18-40ab-959f-370540823029", "comment": "Malware payload (Gozi)", "value": "bf36217993523e9e2caeab574a71d55c08ba9e2d", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633424754, "uuid": "aa5a05e9-bc7f-472f-9c73-08b430053cc5", "comment": "Malware payload (Gozi)", "value": "45a367c83bd641cec1e488db8520b4826f52c5f0585a58daee6fc9d4f5c29ad736ec11ade002047fed28c00d81baca7a", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424754, "uuid": "d7f9fd72-6089-4404-8aee-2c228fc08898", "value": "T14A45DD543A54F510EBA96972CF6AC5F907057D09EFF1B49B78E03E0F2AAE8A3D512301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424754, "uuid": "18e2b7a8-e9fe-424d-83a7-12154c45bab7", "value": "3914a19d88280b08f06c9e1ef6320e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424754, "uuid": "28fc6a56-800e-44ac-ae08-d11b5aec18a9", "value": "24576:xQWi7MQhrgc/IQA3DEEf3cFDZYbZy8zl2ws5KHGv/ChfHOtpfdwuPiHT8XYAT/aD:uxHrgc/IQA3oEvcFtYbZy8zl2wLHGv/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633424754, "uuid": "e501d260-79ab-457b-8bfe-3ccdd75e34fd", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633424754, "uuid": "161a7047-a979-4afc-9768-656e71491159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633424754, "uuid": "31dc5f90-0435-4d8c-8626-6e7dc36a5dc5", "value": "tar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c55e8bb-25a7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633416074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416074, "uuid": "5f933f84-ef1c-4eb4-a214-be7312c00aa3", "comment": "Malware payload (AgentTesla)", "value": "a623acc4d0743b23202a7577b58a019f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416074, "uuid": "3c6641d9-e24a-4b89-8ac0-774c302872ce", "comment": "Malware payload (AgentTesla)", "value": "ff0172ea281631b1b33bb1f5693ca927b02d448616c3bc420c2dcb99ac68ec04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416074, "uuid": "86be8b18-55dd-4eb5-bfa5-4434890b561b", "comment": "Malware payload (AgentTesla)", "value": "f2a17b1369b3ed2fcf65ffefad04512f642d3889", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633416074, "uuid": "2cd72688-3513-4a2a-8b83-187c5b1e8fa0", "comment": "Malware payload (AgentTesla)", "value": "f2c7875e5788e30c7bc467eeb796ef3492def781c85ca515e449ddfd3d5d483c5ba4a951e7e1ecda2efdf3468336e96d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416074, "uuid": "bfa2aa9f-ac7e-4c4c-8673-f7259f72fc11", "value": "T160B4DF94329F9F45ED388FF4182C609143B56C3B61B9D76A0ED5F0ED2A72BB00A91E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416074, "uuid": "675455ad-07a8-448b-bd35-cae3df435545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416074, "uuid": "f73f453b-457b-44aa-a110-2f42f966e37f", "value": "12288:Snocc0WrgCGneyJUOEFs/Aqqy/qHliC7fc:Snrc0WrgJeyJUOEe5YHU4fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633416074, "uuid": "6a2f3691-c8d5-44ed-b99c-f85369854865", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633416074, "uuid": "e73d370e-3ff0-49e6-ad8e-90b7347d3930", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633416074, "uuid": "f3a3addc-48ea-42dc-88f3-4eb848fa8375", "value": "65339917748.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }