{ "Event": { "published": true, "date": "2021-04-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-07", "timestamp": 1617840182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "49810edf-f5fe-430a-9fde-0eb45ec5aefb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648f7c0b-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774729, "uuid": "5e09c6ea-8f6a-4f0f-ba86-75a455958e80", "comment": "Malware payload (Formbook)", "value": "e20d1a790563961f595cc045934ff3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774729, "uuid": "c32559c6-fe2c-46b4-b0e3-2db184522ac9", "comment": "Malware payload (Formbook)", "value": "002ec09931d23f0e66d86eda11ce72113d3e29a1cd0bd296b83ee567981610d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774729, "uuid": "dd62ebba-7d9b-47ac-b850-ab72181cce94", "comment": "Malware payload (Formbook)", "value": "dcc83be883c876754b6babd4c1685c8799ffd84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774729, "uuid": "32b3fbee-7068-4196-9ffa-0376e25cea94", "comment": "Malware payload (Formbook)", "value": "8fe5cafbe256b101d4b9aef7a6de84d24e8652c30c05a7f791154b0e347aeda896955970cd0abc94681643de3ceaefc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774729, "uuid": "9be25566-97d5-4ac1-ae90-2caa3a325b2b", "value": "43E48A3322FD21F7E2680B7845571A2A0F207F356A33990E6A7978F46335FD05963E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774729, "uuid": "0de7c56f-b922-436c-bd8c-6f1164e3ef9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774729, "uuid": "80f3eb01-08d8-45c0-b1b2-12135d227278", "value": "12288:3J23Z3GTLtKNu55RIPDQRPo1HyOiyCyYP2Dm/KLpo:83Z3GTLtKvPDQpwHyOvu26/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774729, "uuid": "efb9baf0-a48b-4501-a4ce-40c5167db928", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774729, "uuid": "21f134d0-e085-430b-9093-bcf414c413fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774729, "uuid": "00b38897-0b00-46ce-995d-a7c96ec761d6", "value": "Certrificate Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985e9925-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775246, "uuid": "87216f4b-7184-40ec-8095-ee128a1f1d01", "comment": "Malware payload (SnakeKeylogger)", "value": "24e814c5756aabcb402b2754243c64d1", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775246, "uuid": "61fcd254-33cf-4b26-9e0d-036be0ce191a", "comment": "Malware payload (SnakeKeylogger)", "value": "0054191bb943290daa62a316bb70797decb5065d37ff631ba789988f583cab8e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775246, "uuid": "ea2da87a-aeb5-4496-9bec-7c930c3ace5f", "comment": "Malware payload (SnakeKeylogger)", "value": "7288624f3babc1d2c6a0971e028477addac66e54", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775246, "uuid": "957885e8-3943-41a9-abc9-255e4aa30051", "comment": "Malware payload (SnakeKeylogger)", "value": "b55a0aa451b9a5df17e9f07b27789a2fd8fab298974edbe576a257f290e955fd11c98f0d1249bbe2482052746dc5bd15", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775246, "uuid": "cf6ee77d-38a9-4e45-aa66-93052aef747f", "value": "2515D02233859F64F2BEA775A061413043F2BD47E376D64E7C9CB19D2A72BC1C262762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775246, "uuid": "d53422b8-07bd-417a-88ce-55c86de75a4e", "value": "12288:embRtRNC32DnLLeVIcvOgz4jTDdXsnrd/JbMeZOkPeTdazdh8qtLKaa+sopucy1:embRkGDnHxcmZjndchBM3kyaiNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775246, "uuid": "ad0eb5ea-0f7b-4a74-9095-f92c4d8657a0", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775246, "uuid": "2ace7037-e38b-40fd-9c5e-1c3731e1f91a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775246, "uuid": "2222934f-655a-4762-a2f4-c782baf495a5", "value": "OVERVIEW .pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae15f8d-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617775223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775223, "uuid": "77748c7b-e1bd-485f-9d51-0304af7525cb", "comment": "Malware payload (RemcosRAT)", "value": "7965cb81f0b9fc92e9e02e53bd32854e", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775223, "uuid": "5465c9dd-6dc6-4f40-bd50-31b0346711aa", "comment": "Malware payload (RemcosRAT)", "value": "006d8434c4eaff7d715c29012b0d9f00b43a52da5a2a438b284014122e664369", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775223, "uuid": "976e71fb-c321-4b8e-a90f-8e6a0d6a52f2", "comment": "Malware payload (RemcosRAT)", "value": "fa951488930a0e926aba6d75809fb29316cbdd98", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775223, "uuid": "bda51a9c-8a7e-4a3e-896a-dddc7ca50bf4", "comment": "Malware payload (RemcosRAT)", "value": "cf2ac380b5c2c480bc9be1d82f609dc5c4517d046d809e5c035255efc99eb5b031a7e5dc14057a6156514bb80f8c1ecb", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775223, "uuid": "61162bb4-4b7d-460c-a867-9f771f82a15b", "value": "BE15D02233846F65E17EA7759060516093F2FD07E336DA8E7C9CB49D6B32AC1C262B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775223, "uuid": "5407e4a9-62d0-4219-ae48-6fe7cc0a0b93", "value": "24576:YebsanDn4AomQlSesV+qQ8B8cHvNlEXHPzj:UaDnn7QcjHEXvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775223, "uuid": "e1ab7c8a-1b46-4784-8ff7-706e5b1c7287", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775223, "uuid": "dc439752-2ed5-4f9d-92dc-5f7e78eb4309", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775223, "uuid": "2ce6f603-271b-44c4-a563-ff8a9c6bb413", "value": "PO-3175704534,PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68991d7-97d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822541, "uuid": "eb53aaaa-cce9-4b7c-8315-a67cc156ef76", "comment": "Malware payload (Dridex)", "value": "1191e1546bdfa1e850021b3792484b36", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822541, "uuid": "0a9cf597-5ed9-4ad6-9d44-d6c7d5175b35", "comment": "Malware payload (Dridex)", "value": "00abfb8cfdda6488139934326659b7ffbfdf677eb22839e7529b2a17464da18e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822541, "uuid": "ec86e677-a024-43db-85f8-d13bcbd9eff2", "comment": "Malware payload (Dridex)", "value": "3f87fbb10c0f6ba4d32da4bfe16eb10f707de17c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822541, "uuid": "fea9a5d9-5f0c-4411-8f4e-b8aa145df3e1", "comment": "Malware payload (Dridex)", "value": "1d3a998c9c7af4f961e84cea4d30f2132ec67e6cbdb49103c748fe5c4ae33951a5feac1612b1927a0fdec0ea96bd9710", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822541, "uuid": "502ee2d0-9da4-4b0b-9154-923d8068f95e", "value": "9914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822541, "uuid": "402c8a1e-5169-45ae-832f-1291b55f734e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822541, "uuid": "2f8707b0-fe8e-4cc5-b06a-72134a1a2189", "value": "3072:pBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:pBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822541, "uuid": "6d76f7d3-2752-4714-95db-5f3c3c714a5a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822541, "uuid": "3f44703f-b8b5-43e4-be1e-72b36eb704f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822541, "uuid": "80b4f5b2-b50d-40b1-b621-a169a9bb6750", "value": "00abfb8cfdda6488139934326659b7ffbfdf677eb22839e7529b2a17464da18e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c73893d-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1617772488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772488, "uuid": "12577d07-3b2e-4efb-83f9-90418234f99a", "comment": "Malware payload (RevCodeRAT)", "value": "6e74ee737021356a410d16ee3f974205", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772488, "uuid": "a09c80c8-e20f-4e4f-a8aa-64635eda6ce8", "comment": "Malware payload (RevCodeRAT)", "value": "01a0edfce737d16102372ac1228f4095a3bdab926ecbccf64b452a4e9972a59a", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772488, "uuid": "2198ef97-a5f7-44aa-a357-d7a8531abcc8", "comment": "Malware payload (RevCodeRAT)", "value": "25b34754ee49727301a103f5ff7847d0be527aec", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772488, "uuid": "0c6e5cae-1cd7-4346-abf5-c6d7a1b2f32a", "comment": "Malware payload (RevCodeRAT)", "value": "31dc0d512bd0da98144766b34dbf578d4793882b2a1f975b6417d3aa18d7eeb31692fa5c5102f80a0205ad256bba5aea", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772488, "uuid": "57182c1a-4591-414a-8f7e-96eab2fee297", "value": "A15533C65E018D8F4EFDB02A032653709A80A92865D7CCAF87D4F181B7B5FE35ADC856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772488, "uuid": "6e1f6942-202e-47ae-873b-4bbffb6d04c0", "value": "24576:9J1h37I5pBwpmIwbZAOgYpSwrVxPPQVACEBzPvzPe0n4NFceM1n+EakKT1B4hjHG:T3k5gpmXZnJ5xxH2byz3J4NqeM1+EBUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772488, "uuid": "689d5a14-659d-400e-a8c7-0e6b29264753", "value": 1326850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772488, "uuid": "06a1804d-d171-4273-97cd-22c8383ca2ac", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772488, "uuid": "9bde9b87-4d9f-437c-bd58-a26a43b6d207", "value": "JANUARY OVERDUE INVOICE.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc44d3ce-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824376, "uuid": "db1e2ddb-8cd8-4380-91c3-7a43c9d7bdb8", "comment": "Malware payload (Dridex)", "value": "ea19233a8860f5dcf59736e2598329eb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824376, "uuid": "ace2be14-a36b-4235-b0e9-0a44b336d588", "comment": "Malware payload (Dridex)", "value": "021919263cefc53c999ae6a9727abf4c26184b222459c83724df1f137eb8e333", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824376, "uuid": "2cbfa0a7-002e-4d4f-9092-ffbec95adcf9", "comment": "Malware payload (Dridex)", "value": "da36fa20f8d5612cd0707697207c38afbc81f9c4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824376, "uuid": "8137e2b4-994f-4799-995b-97df29f954c0", "comment": "Malware payload (Dridex)", "value": "fa784e5dd072bd44f828eb89452c85793baa528ef677790792b4a04fc6705412ef4d33fc627ebf38954a865a71009d82", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824376, "uuid": "039e69bb-20a3-4e6a-b1d5-ba6fc736c8ea", "value": "BA249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824376, "uuid": "64028cab-a1fb-4d50-a6bd-b3329e1bbc0c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824376, "uuid": "da620fc6-c112-4817-a177-3ad902433ac6", "value": "3072:70DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:apepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824376, "uuid": "b57adcd3-312d-4835-876d-ac37fbed2caf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824376, "uuid": "5143012b-d9ba-4557-88d4-3a49e8a30293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824376, "uuid": "43be3b61-505e-465f-bb35-87d1a1461fb6", "value": "021919263cefc53c999ae6a9727abf4c26184b222459c83724df1f137eb8e333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfdd1d0-97c4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617815571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815571, "uuid": "ca6f6f7b-1929-4475-bd09-784994a26b23", "comment": "Malware payload", "value": "212968f5d3b24f31be8a8a09df77d655", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815571, "uuid": "d4bfd3aa-f371-47ac-9688-0462f5e47f64", "comment": "Malware payload", "value": "021aa4f8f22f4564d6e816d79887d7b83bd0ca7d688c35c1884866e5ab77e763", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815571, "uuid": "e5d59784-3c64-462d-9e5b-cf4ae5ca8d51", "comment": "Malware payload", "value": "724ae44b46af48d326618f8630ea3f37c0d600a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815571, "uuid": "ecb268d1-3c04-4d4a-a27c-792f9e27c82a", "comment": "Malware payload", "value": "4872942a429b5acfedd7bc1d05710998ecda0861e8d78a200ccde83a53464d539e8c918fd2bc28628d7ccc0e330dbd06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815571, "uuid": "34d5ee04-a393-469d-87ef-10642b00272a", "value": "1F0533E08CD924E57FAFD50A9B19C5772B930261A5B6B03D861774D4D3FA2F1E20836C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815571, "uuid": "215fbcda-df2b-45c6-a658-236252764bd3", "value": "24576:hLr+mZV47mdvWsZQCZVrI+EboPQVsaPKak:Nr+mX4mWmVrybuQ2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617815571, "uuid": "014b5292-3016-4218-9a35-ffd153f4616a", "value": 865261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617815571, "uuid": "142a1af5-152a-4e02-95b8-c20ea2f5ab95", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815571, "uuid": "4b9646b5-8bd4-4c6a-b316-30c3a3f6bf62", "value": "LIHUA Technology (HK) Order Items.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b465fd-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794433, "uuid": "abb0b8d0-29ef-4897-8405-3abb1d48f58f", "comment": "Malware payload (Formbook)", "value": "edee2fdfadf88e84ca4136861633d099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794433, "uuid": "4c748aed-7abf-41ef-9abe-b6502c3a7a85", "comment": "Malware payload (Formbook)", "value": "029626fb22c7446fc6f2abd2551252a08507c68fd035d41694e2c77b6e868698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794433, "uuid": "86fdf40e-02f6-4074-a2e3-b5f5c363a3c2", "comment": "Malware payload (Formbook)", "value": "b4ba9b4d8fa29ee9795e44fd6020633d8ffc898f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794433, "uuid": "6513c37d-4180-403b-83b5-ce20b57e9034", "comment": "Malware payload (Formbook)", "value": "eb6941a786bffeb8d93beddd01884f88b14fddd2c6f1b19eabae42a73daae50dfc72f475dd723baf682d8323f27bcfc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794433, "uuid": "ca689a91-015d-4574-9668-a21f828b0082", "value": "BBF47985200ABB29C6090B71BBA6D00D4F7759B6A9C2C50F35D97EFAB7AC14CD70316E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794433, "uuid": "5cd37bc7-2fc8-4f48-b4ac-2f95284cb36a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794433, "uuid": "f917832a-179c-49f9-9826-00477a5fc3e2", "value": "12288:u9eh87mFkkFpg6dYq5JNJiyOiyCyYP2Dm/KLRw:u9ehAmJFW6dYWJNJiyOvu26/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794433, "uuid": "41d25340-c692-48f5-8394-747a06ad1c6c", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794433, "uuid": "110c562f-67bf-42a1-9331-045c8ac12d33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794433, "uuid": "03be04eb-9dcd-4d2f-9a44-68a39b0cada8", "value": "Order_April shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c7dce9-978f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617792879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792879, "uuid": "30b3ba19-2497-4b79-9649-46d31b6a2263", "comment": "Malware payload (AgentTesla)", "value": "485d4206da33176ad5f8895772af0ea3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792879, "uuid": "97d13943-165c-476e-b5ce-655e605fc6a7", "comment": "Malware payload (AgentTesla)", "value": "029f513c57383c132136eb7c26c9b6808729acc0828c92ae73b6719f51e190bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792879, "uuid": "3472b3ad-cb9a-4dca-84fa-da84d83533ef", "comment": "Malware payload (AgentTesla)", "value": "fabce7b19eb69d91eb8a1ea476c6e5dfaf626565", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792879, "uuid": "abaf224b-a0b0-4325-84a6-e46bba45fb86", "comment": "Malware payload (AgentTesla)", "value": "d4ad826e35a4bf41b5c1dd2fbc76e9abb916c74236983290f423bfc22024baf850405867c01e2a1085ccd54fa1bcac58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792879, "uuid": "59f9027a-3b17-4e31-86d1-8bbaa39a5ac8", "value": "9405F12227D8DF41E03F6736063260505BF5BE2EE326E62E3CD972DD1A72A045673B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792879, "uuid": "f9c352fc-edeb-4660-8a14-8e619401aa45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792879, "uuid": "ef75f56b-e61b-46d6-9dfe-5c2b424b5af3", "value": "24576:S215LUNSq1xFjeWgs+sfL2c2dIyvAmOD7tV9O:S215LpqzFjehML2c2Ymq7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617792879, "uuid": "e8ca62ef-1833-4e88-9d8b-3f4bc96f8912", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617792879, "uuid": "c5901e9d-59bb-453d-832f-79047dae833a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792879, "uuid": "30a46887-dde7-4899-8e8f-3eff5ab1408a", "value": "77iET1jNLJyV8ez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8426e9-9799-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617796998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796998, "uuid": "d5215ffb-c3f3-4037-959d-6fa0ad4313fa", "comment": "Malware payload (AgentTesla)", "value": "8fe651f5f6dae40eb4849bc7da967127", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796998, "uuid": "144b5acb-06d6-443a-986f-8275518a526b", "comment": "Malware payload (AgentTesla)", "value": "04e087bf8ba8357bc1f0b431c45af9c0176d7ca278bcc053e8115dbcc9938afe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796998, "uuid": "0fcff965-60e6-4192-bb83-411e0818ba89", "comment": "Malware payload (AgentTesla)", "value": "dc4c75f987276e396e4d8754d8c899bde39a84c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796998, "uuid": "bc041930-c1b2-4250-abee-e32abe93aa07", "comment": "Malware payload (AgentTesla)", "value": "213cdd368bfa0afafbc82e3347499dbe816c733ba31cde5f3731dc9401faec96aee4e4e08436b1117588cbd0e90f16b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796998, "uuid": "f571497a-ee1c-40f8-9dac-5574d0391d1d", "value": "EA15F121270496D2D5694FB3BC2260026377EDC92963CBD89A1CFDC5263770D9CE4ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796998, "uuid": "e0d97ee1-b2ac-4462-a075-04f76305620b", "value": "12288:72iN8fMwGxJiAd1tUErEY/jwGQUn1Quol2hWBA762lBkJxBk2t:71GfnNAd1tJrEokPuol2hW+76YcxB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617796998, "uuid": "11f2757b-81ad-4a3c-9acd-9ce20bb11c25", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617796998, "uuid": "7213d56b-09e2-44ea-8c3f-daacbe1978a9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796998, "uuid": "d3007717-74f2-46ff-b4e3-bd0f925a13df", "value": "INQUIRY04062021_4972.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08cbff1-97cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617818639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617818639, "uuid": "08b15baa-b9d4-4dd7-ac2e-1281a7f06dfc", "comment": "Malware payload (Dridex)", "value": "5a88cb2b99d5a63d419278a412e91849", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617818639, "uuid": "f99c18fa-4269-40c0-afea-111e1aeb4a23", "comment": "Malware payload (Dridex)", "value": "04e76637fcc5bcf8a11001b04d8f3db1ed6816352452dd75962199291859af38", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617818639, "uuid": "434ba71f-b00b-49ea-933a-69d8aacaa4c9", "comment": "Malware payload (Dridex)", "value": "eb58c2d80d0e6e5d030c5b069dd28b6c658c24f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617818639, "uuid": "b88ab7c3-1de0-4df7-9ea6-8558b421c440", "comment": "Malware payload (Dridex)", "value": "b0eb26f2cc28647d19be23cdc80fd7bfadb29edaa8549a82d1eea0c16f161beda398140b24b31e50d2e571060864920c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617818639, "uuid": "dd2d9d2f-9a51-481e-804b-45a00a951a12", "value": "8203D09FAC39DD1EC1B6047EA9A94CE426140E04E113E96B2D10B2DD66934F34B9BBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617818639, "uuid": "e5141d57-16be-4248-997f-ea67da7bede5", "value": "768:bTNIjJRuIhyehySDfSURzXO+iBMKhu7eFaR/ZJ3V93thchb8ueH9te+:ObJUehlqUt+++MSuiFEZlthYBedB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617818639, "uuid": "054c2327-17f9-461a-bd56-fd75dad08f67", "value": 38459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617818639, "uuid": "5d9819e7-d835-43c8-8b56-37a4d3ac634d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617818639, "uuid": "51cd483e-299f-4a59-a341-22621f076c8a", "value": "980026 .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9525583b-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617775240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775240, "uuid": "31a71f94-72da-4f1e-86db-7c2a09b37a0a", "comment": "Malware payload (AZORult)", "value": "0cee1aa638e1567fb8ca607cb2a1b856", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775240, "uuid": "c41c97d4-49e6-4ac8-929f-95859b7fe6e9", "comment": "Malware payload (AZORult)", "value": "05cd2720dea041fe91b4e94c8497ff6a41ee1adc49cee68cd85fc9ed7bae3148", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775240, "uuid": "e722e72a-8a72-4775-977e-2ef0450814c6", "comment": "Malware payload (AZORult)", "value": "b556eca3911f2949b5667f11025ce3d1388d8158", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775240, "uuid": "39969ef9-0d46-4d6b-8cce-5684e51d5f36", "comment": "Malware payload (AZORult)", "value": "9ebf62780cc772a7ba79f09d3fda0272f2a5404aa8a7e04d6b71d08f3da4bcba8e4e62e5107fcb5a552a25a67b796674", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775240, "uuid": "dcd76946-4233-4f99-9993-337fa132db38", "value": "E64423618D3601DE58CAA28B9DF9A05DD26EF8B11134463FC6BA23B489C1E817DF4375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775240, "uuid": "c1b7ebad-a2b7-4d23-9372-a36e9cdf7a32", "value": "6144:2Ff7MaeLqiIvh/x+T+ED9nazA7XlV4CytbpZ2iM3q:6AaqIvzKazKz4CytbH2iM3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775240, "uuid": "19f5e400-6aa2-488d-9582-93495aba9fd6", "value": 257878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775240, "uuid": "e4b92892-dc32-454d-ae68-be99507b113b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775240, "uuid": "45e2ff1f-0e74-4ff7-b6e7-9b33e3bcbc17", "value": "IMG_767893434432.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d342f59-9780-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617786260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786260, "uuid": "dc22fe0a-16f5-489e-a166-8153459d19a5", "comment": "Malware payload (IcedID)", "value": "e30c71417d7675c13ca725d3bb4172eb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786260, "uuid": "ce8d03e5-6362-49a7-8a7a-f12fed3bd3ad", "comment": "Malware payload (IcedID)", "value": "05d2f75e43502476f32925c3f8ca82245c4f5433c4d405779e6fd178cd37ea13", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786260, "uuid": "aaffaa32-4b39-4e41-b648-290781f57fdf", "comment": "Malware payload (IcedID)", "value": "80350061fb497c3fc79ac2cd4f8a315aceae412e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786260, "uuid": "21ba391b-8b9f-4076-8f33-d17f57b7c94b", "comment": "Malware payload (IcedID)", "value": "65455a8fa73beef62e13298b0e2e2f96125580edde485759f48f6c79fbaa05f00c956e3f9db58db602064ee8b3c7fe47", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786260, "uuid": "51afe031-f241-4916-9c1a-280a6b31f144", "value": "D0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786260, "uuid": "1275d90b-1784-4390-a80c-c9526d6c63ac", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617786260, "uuid": "21ac93b6-ec65-49d3-b509-7d0dba7c15de", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617786260, "uuid": "619b8fa1-e221-4b0e-b835-5b659283ea6e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786260, "uuid": "4ef78ca5-4dd6-49e1-8036-967564eabfa8", "value": "document-1245492889.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0119f5-9799-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617797049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797049, "uuid": "061d5551-9167-4fc6-bb13-6105d446a22a", "comment": "Malware payload (Formbook)", "value": "bf0b88eefa71302dc67b4fe77f28dd10", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797049, "uuid": "e820933d-8468-45df-bb5a-d7f6eb2d270f", "comment": "Malware payload (Formbook)", "value": "07f9b01188eadf64fd4628d440e47a7ac76f72b9be385aad33fa48c67cd9743e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797049, "uuid": "3bb374c6-ace4-42c4-9711-bb9ae93a7f82", "comment": "Malware payload (Formbook)", "value": "cb9d609b4d118066c232e8201bdfce51e1b86d18", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797049, "uuid": "f75d5016-0f4d-4b08-a77f-b20194b71716", "comment": "Malware payload (Formbook)", "value": "9912301122036f8110c3d0eafa87ecda4e2d3fe919aa5f3ff0b2525f4ef77d3e8704dbb9423c010594cba4ef85376b4f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797049, "uuid": "ce32f0f7-abc2-439d-93ff-1c129a4d5085", "value": "32D479106E5407C5D5E9B6F09C21C2510A6DBE12B7E2FF0ABBB075684AB3633DE1162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797049, "uuid": "cf49313f-64c9-49ce-92b3-5f5d73ffaf38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797049, "uuid": "d9fb3414-ff1f-42cd-a828-dfc6a3a11da4", "value": "12288:Qh+kKUSSD9mUaWaKYks2sgJ5RrPt/jJwyijjF1wJ4M6zyDW5z:QlKUSSD9O6YkfsgDtP3QI+zyDW5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617797049, "uuid": "086e04d2-8370-4785-91a1-501e1dab2882", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617797049, "uuid": "25b5ec06-93e9-4b77-8885-dd57071bbcae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797049, "uuid": "905d45a4-085b-4ff5-9f86-d966340f4ebf", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c651af20-97f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617835023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835023, "uuid": "e5225419-9f31-43b7-b2fe-763179659d60", "comment": "Malware payload", "value": "2939f396d5b175b2e1f28b05c09e812b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835023, "uuid": "d2286811-99aa-49b9-a85d-f5e18e72abc1", "comment": "Malware payload", "value": "088d508c5f4509185682108b422dcce6d1ca6ce82258f1340ab4e330da067b22", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835023, "uuid": "9cec7ab5-f222-44a1-bd82-b46334facab3", "comment": "Malware payload", "value": "d040e2a1d29f0b37a5e888d2402432d78440cb54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835023, "uuid": "1bfc0de5-dae0-4785-b1c4-9e8d6e2f8d21", "comment": "Malware payload", "value": "c731c8f78062ff360e15401933d711d0b8ba657d3db75d6c2be7ab19d6c8f97d6092ebc7102eb75e02679e7c80e47f78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835023, "uuid": "d05694de-301c-4acd-9f47-488dc031e259", "value": "80C4D0247A51C270E07F07B9CDB389BC45796DF21A65C543BF8A2B2D4F603D9AA36306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835023, "uuid": "53ad6673-0068-4546-83ca-c1c1365acc5c", "value": "f9b1213ff998546e2cafbc29182e1fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835023, "uuid": "f157c715-9753-48b0-8c93-b5b6a7c42202", "value": "6144:H4Qq8J8SuK1ypY23lAF3oUooua2TXOGUIQ33wodqrxWWYwPPydyqBh+hF62S:HB1J8Su7bgYbDkrErxQ1y/pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617835023, "uuid": "2bcbc1fc-9e8d-48df-a693-53c968ef6636", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617835023, "uuid": "fa0f8b62-0358-4726-9791-1e06ad8b3d8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835023, "uuid": "c8847f2e-ed7c-4d31-9bee-efbb8938556c", "value": "SecuriteInfo.com.W32.AIDetect.malware2.15740.10016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc834c2-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "faecbb7d-401a-40ae-933c-3a61a3495547", "comment": "Malware payload (Dridex)", "value": "d5ef22bffcf67bb7c0ad46915a8b4845", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "62f57a20-030e-49dd-82be-bc2e73b2075b", "comment": "Malware payload (Dridex)", "value": "096b0a6c70272b9bbffbe967981c42ba7df4899a4377d59c5ee136568180bfa6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "5d940c69-11d2-4a40-8f43-c9864a45bf5c", "comment": "Malware payload (Dridex)", "value": "53bb4368ff4cd32a7d0a5379e516c4b8f10bf9f1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "d3c1b3b1-9eb0-4412-a835-52dc21c3fd0f", "comment": "Malware payload (Dridex)", "value": "7e855341e2fef62d78c1b939d159732c70c6584cbde02001819ec2e1bbe12579aaad477541e919b861525370cd99fe44", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "8a12a1c1-3574-40ed-9714-88e8a3d6ffdf", "value": "C6249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "917b6508-17d2-4256-b212-bba02efe23b7", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "0768e9aa-8b39-46f7-b26b-c4ad9bdaa72e", "value": "3072:v0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:upepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824375, "uuid": "332a521f-0817-4d3f-a5c7-167d50c1633b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824375, "uuid": "a7af277f-fc9f-49b1-86a6-a0b16035ca95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "907a2d06-6061-4320-94f4-964fc7342ddf", "value": "096b0a6c70272b9bbffbe967981c42ba7df4899a4377d59c5ee136568180bfa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267f5d43-97da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824876, "uuid": "31665f00-935d-420f-ac20-fcd3f4dab8a1", "comment": "Malware payload (Dridex)", "value": "cf48b9163b0c7d632ec3a803fcca150e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824876, "uuid": "90ab9a50-5622-4010-8131-b5aaf626f44c", "comment": "Malware payload (Dridex)", "value": "09f5112e955ad6ef6ea22fbe5b2a820ca68aca435ad1752fd25f434fbb5adfd5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824876, "uuid": "445cddd3-02fc-43b6-92d7-8467bbb3ed77", "comment": "Malware payload (Dridex)", "value": "2539050cf50b773af3bd47180bc060bcbc471277", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824876, "uuid": "80a4bfdd-3b5c-4a88-b32e-1e529f637e6d", "comment": "Malware payload (Dridex)", "value": "19a5fd5d18226ae38a6fc6e9710b03d19bbff49bbbe9313527e759930586256e37f925c319b63df41bc5ad967224da41", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824876, "uuid": "8dd95cbb-f37d-4960-b010-2f8a9dcf8a45", "value": "F9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824876, "uuid": "9fcecd72-2d0d-4145-ac9c-3a7595037d4f", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824876, "uuid": "2ea63ca3-cc78-4f00-8fcc-3383b703085f", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824876, "uuid": "bec235e1-3bf2-4ca4-80e6-acaf5fe8a1cf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824876, "uuid": "93cf2676-810e-4218-ad62-b97ff0ffa716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824876, "uuid": "c2c02821-1114-4f66-b81c-edfb8879fc81", "value": "09f5112e955ad6ef6ea22fbe5b2a820ca68aca435ad1752fd25f434fbb5adfd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379da100-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794411, "uuid": "afe1449b-a32f-4387-80db-e65df359fb78", "comment": "Malware payload (Formbook)", "value": "406a64ab57ea700d2ecb90349fffe44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794411, "uuid": "a7161bdd-93bc-4f81-a406-fa33760d7233", "comment": "Malware payload (Formbook)", "value": "0aaa10495fff6567ec8ecb5fa1ea118ad1b1230c77db540c0dd7cb6f1d26f6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794411, "uuid": "03f2e213-143b-4cfc-8f03-cf395d4fdad4", "comment": "Malware payload (Formbook)", "value": "a2ae6c81c3ac4dc20a05a69ce116d39cc1c35ac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794411, "uuid": "502990e1-41f6-447c-aad9-fb626c7d6d98", "comment": "Malware payload (Formbook)", "value": "8444efd6cebd8774d0e0e5e2c8862a98f4a8f0afd744c77da29640746db5d9cf79f086db71b790ced0d4a24fab2bd9d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794411, "uuid": "14cbff33-7c0f-4008-9ee8-4d4b7b6f1f81", "value": "EC05E055ED8096E4CD2D93305A3BC83907237D7DA5B8940D31E93F733BBBAA30026A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794411, "uuid": "4f06bd80-5214-48f9-93ea-0b20e5b323df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794411, "uuid": "860fd00f-5fcf-43be-816f-0da6dfbbfdb0", "value": "24576:/twrBQB9+KtKvPDQpwryOvu26/iWEaW0iUuyq8a9:+19vPDQ+eO226/lBuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794411, "uuid": "ec459e26-ada4-417e-b42b-34e743c4e931", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794411, "uuid": "b1aee6d9-c7f0-42e0-bc82-25390e0776f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794411, "uuid": "a07a17db-a0dc-4800-9d56-79452ee809ad", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e22fc5-97da-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617825191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825191, "uuid": "ecd56e1b-f81e-4277-9306-7110100fa28b", "comment": "Malware payload (AgentTesla)", "value": "cf96aa3b2ffdc3cded291b70dd098648", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825191, "uuid": "a8a4829d-c1aa-4b72-ae54-ee06738410e5", "comment": "Malware payload (AgentTesla)", "value": "0c00f0f3395e4d5756612d481f361d9450bcb56b3a528001da0b4649d9c0313e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825191, "uuid": "f131526c-b477-4672-a3e2-8eebee2a6c1e", "comment": "Malware payload (AgentTesla)", "value": "24b1280484f4d8f3e7cefdfce6cee5ea6d07093e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825191, "uuid": "82d5ce32-80bc-409b-becc-0b1977680ddc", "comment": "Malware payload (AgentTesla)", "value": "597d441bc576838c29110d0f1c437c14f25085e11bbe3803fe3b6aba56d8e846a22e4d3f5f38ddedfecf20bcd4c95b7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825191, "uuid": "14490e78-0e7a-4228-8a9f-41a6d58591fb", "value": "8D151272B354DA20C86E47F6941344478332F2C8A913EFA5461C93D5395AB8DECEADC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825191, "uuid": "0e0953d2-d82f-47ac-a08a-0597654dc8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825191, "uuid": "861f80c1-b1de-4245-81ca-aa571638390e", "value": "24576:MpR434FyNPazsbts+3jBeYTQGVBXI13GATS:MpR4ZPxjBMGVBXIQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617825191, "uuid": "e3ef8f06-2d1d-4be8-969a-676ae84d8451", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617825191, "uuid": "b0cb9145-1f1c-4bf8-ae48-46c9b25fea52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825191, "uuid": "0122068d-7b23-4986-bbc7-9c179a41902e", "value": "PU Request Form Hardware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b393d1bb-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617768420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768420, "uuid": "3c600e36-6c26-49cf-a4bf-6b77fcf1a2e0", "comment": "Malware payload (AgentTesla)", "value": "0186a76dbc7ee5ee38ceab98b842cea8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768420, "uuid": "12a2c822-bf6a-4231-8797-25571c0e7e81", "comment": "Malware payload (AgentTesla)", "value": "0c1f3b2a1ad7435a0096c508a947841c0f87f2bad3e43be1539d1570073493c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768420, "uuid": "841d08a7-1e31-44ae-8e14-b7e7ea9ade5c", "comment": "Malware payload (AgentTesla)", "value": "c2be8358d3432e2a1d7848b763dcf2714a5e48ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768420, "uuid": "e6f066a2-17cb-4df8-aa32-aee5a3f2b474", "comment": "Malware payload (AgentTesla)", "value": "77b0667a944a95e46f362d7200b9b701836da722b552e9d2e40f93627c6765aeb5e8322d124f980a1bda1977ba4381fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768420, "uuid": "8f97e465-6921-40c2-935f-37498ef27ab3", "value": "1DF423A1117AF33637535A08DD74A3CACC3E3C97946B5E8D82D34B84E8941EDADEE091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768420, "uuid": "9442b9f5-3746-4a21-bfb4-f1140a8c4a05", "value": "12288:9wKjx+36gvaOoGsSTMq56GbptA7SjhN05INvbmsAyJ+t3zRl6DNpYnuA8hp1cCan:rxDgJoGee6euSlNywCsAYY3tl6DN4mhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768420, "uuid": "f84ea4fe-5064-4644-af28-cef46230a89a", "value": 773353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768420, "uuid": "72f55e15-204b-4f61-80fc-1d082666d5a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768420, "uuid": "5bd03ec2-a2dc-4f78-9e79-dfacca3274de", "value": "QUATATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c1866c-97c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1617815123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815123, "uuid": "a8e03d96-6078-469e-9e38-4172b0dc16a8", "comment": "Malware payload (Stop)", "value": "713b717f0b083f8858cf2f590a52edbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815123, "uuid": "2ac0e4a4-8e8c-4b06-9b91-c46e3f8414a6", "comment": "Malware payload (Stop)", "value": "0c331b2e8e369b35c3094fa746a4486f4d6f7d3962936a9a389574905b2fdcd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815123, "uuid": "a472f714-1635-4604-9034-48b1636acf36", "comment": "Malware payload (Stop)", "value": "0fa78e391d73ed0298fc7f005553512ae1fbffb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617815123, "uuid": "5d0cf0b1-7e41-4ee4-a8bf-03d11229a5d5", "comment": "Malware payload (Stop)", "value": "ccbaa4d5d91e86ffbbaea89b9be730784c82fda17513ca5cb6589afb9f45afe3ff65ec9b4ee4523868e9c17e80ff3283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815123, "uuid": "2bd7a9fd-c08a-4a52-81a9-5653cad7f7a4", "value": "C9E42312B0D5D572C5B234F09C27CBEE083FAC53AB3AC15A778D1B567E12AC44A3A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815123, "uuid": "4a4c2a6e-2410-463a-94bb-dce15334be01", "value": "add7594dd05ba3809b7c17482161f90d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815123, "uuid": "304fdb8b-29d6-4ce2-9d0e-e60152584593", "value": "12288:ez5Y4Q/lTwH7JvMuh5lcarc5WKN5afHikQhgjh0EvJ2gOI1gg/H:eV5QB23h5Zrcv62hmJ2gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617815123, "uuid": "bd174282-b008-4085-ad34-08b037c219bd", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617815123, "uuid": "a7ded151-917c-45d2-97e6-8c2c38dc5d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617815123, "uuid": "e2d52168-cd37-4bc9-9657-d575c8c9e8fd", "value": "713b717f0b083f8858cf2f590a52edbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3997a1-978a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617790713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790713, "uuid": "599fc4e2-92be-4f6c-a99e-6b6a3664852d", "comment": "Malware payload", "value": "9b84e8806463cef8273566675c54091b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790713, "uuid": "30b4fca6-dbf4-40d7-be3b-e63880d97f10", "comment": "Malware payload", "value": "0c3a27a62648a58b20ff907b045f86e7ef7a3476610f0972dbae8b0ae97a8683", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790713, "uuid": "8b7ff42f-1401-4cf0-b214-b33c869b4fc7", "comment": "Malware payload", "value": "272a7fd65eb31497d549f52804c0a806c8559dbc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790713, "uuid": "a1a6c9b8-c34d-4a69-b863-c8265e1f8f49", "comment": "Malware payload", "value": "34c208c4b2e6489a3806cf5f3a811733b100ef5fe4ad363589a742301d66b76ab4814a38b8784ddac8ee1c33992c557d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790713, "uuid": "afd7dc45-4db3-4c1a-9570-457f66b345ae", "value": "F6930239F6A2E206D814726B61A4F0CB7309926F8D6D2476DF43184A08D8DFB5D1C92F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790713, "uuid": "d7d25aa7-ffff-41af-8a69-9c046464259f", "value": "1536:4rNZTcIWgcDp6l8NPi54mSKOJmrXIye/6v02CwQVxEHhr5t2maPWoIPQA1:4hsgcdKYmrXoO7QETK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617790713, "uuid": "730e1871-6338-4b01-aacc-a64ebad7bf5f", "value": 90155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617790713, "uuid": "d3348e22-2f65-4126-8b97-437d71c9eb72", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790713, "uuid": "03672593-39c5-4550-b7fc-89301775bd32", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d55306-9790-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617793435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793435, "uuid": "ab41dc48-9279-4b73-82db-fe00e6aa17bc", "comment": "Malware payload", "value": "5c44bbdccdffb3fc06e0ce9b6ff3d7cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793435, "uuid": "0c6ba13d-7e34-4750-a683-724f6cdea82a", "comment": "Malware payload", "value": "0c9b6f33b918e6fd93807ff3160c65c6c6e4117b1bf0c2ae36beff0a3ddaed31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793435, "uuid": "808eae3e-a604-4d3b-99ce-66b4bbc52555", "comment": "Malware payload", "value": "372aecc5531723314f3e9998f8268c437ef1ed55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793435, "uuid": "a65a7ce7-ea66-4835-93bc-59af30ecb800", "comment": "Malware payload", "value": "f59963934ee776be420bc8be36987a086389d168074317e0bd414f8ccbd2ecafe7eb59a362a710f8b3bf556e86136b05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793435, "uuid": "6b034e9d-94b0-4f7d-b85d-2cb9ec807c6b", "value": "B424D86126FE7518E373FFB215F43ABA1A2ABF35A75FF1BD6002480D56125805A32633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793435, "uuid": "0968e9c0-7410-4147-89bc-4a3d3d1da1b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793435, "uuid": "ac025068-b41d-40c8-85e1-4814097d825b", "value": "384:eppDMb6os4MteBYRITorN79ToKjkaAXK+dIigA+796y1TYAafQ6bn8:XmjNWK0FI0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793435, "uuid": "b0d77465-7579-45a7-b477-13b85481c231", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793435, "uuid": "165755d6-00da-49c4-8b7a-db13074a41c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793435, "uuid": "fe83d1fa-940b-4475-87d5-e9e60e92a0d9", "value": "SecuriteInfo.com.Artemis5C44BBDCCDFF.4370.23318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b764cf1-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774768, "uuid": "b59afdab-5739-43ef-8ab6-1d6585086e3d", "comment": "Malware payload", "value": "46b7c8b30d4e807249088f51bda054c8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774768, "uuid": "c3e8b46a-8356-48f9-b6aa-e52e4e43e585", "comment": "Malware payload", "value": "0cb0afe26a5ad47d7ae0a80dc0dfdfa570cfae9988a84e6a6a354fc466ed45b7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774768, "uuid": "13255f0d-36e6-4faa-93d5-ad0975937f18", "comment": "Malware payload", "value": "f692e7c94d898acbe23881ef36ac2b8b281d79ca", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774768, "uuid": "df8ff8da-fb20-4c33-abc2-98345916f268", "comment": "Malware payload", "value": "3b13fd5913dca5196b4b4d236e3e5e730425e325717649bb12d3d3469782c4a41f082e5cfd10ac7e8acc232791d3b53f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774768, "uuid": "e29e5075-268b-4f3d-b322-eb4acf8dbc97", "value": "9F113E85D408D56DC2B7819201B583D082EF70CAC15485624FFCE8F240D4444BB2B5F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774768, "uuid": "6acd4721-c30c-4ee9-999c-3073e93a3196", "value": "12:bKbwDWzRR7eMOv1KEhRjmSCWoK/3kgbjjInGHpcn969g0baLPCpEI+V:bKiWVRKv1K8R6AoKHWD69g0beZIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774768, "uuid": "f030db0e-58ae-41fe-a8e9-0a112aabeda5", "value": 996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774768, "uuid": "fcec35ff-d890-4fa9-8450-97076a8dcfb8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774768, "uuid": "df774857-b66d-4cb5-8972-773f15bd819f", "value": "OH76.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8922e3b3-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617774791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774791, "uuid": "e8ca127b-00c4-4690-88df-e47b6bf2ae02", "comment": "Malware payload (AZORult)", "value": "023215924c23ad657d1548b49c5770bc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774791, "uuid": "1163d72b-f9d9-439e-90da-efdd9a02ea11", "comment": "Malware payload (AZORult)", "value": "0ce4f6e71e484cebce7f69ca5be2c4ad6af62a637c7aa1e303052e43e0355720", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774791, "uuid": "b5622035-3fc1-4943-844a-675fb875bc9b", "comment": "Malware payload (AZORult)", "value": "990870961f821b677eb246dcfe0822b7b11b22b6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774791, "uuid": "04476a46-84c3-4bbb-b4a6-6d4ceec472ff", "comment": "Malware payload (AZORult)", "value": "c6cf6ca8fe1ff24459fad0d365e0b536e4fa8a842d50cbdb8ccb8429dd2ea2c2682c96eaf9162ca076efbf302b5646a5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774791, "uuid": "9b4c4f03-1ca7-4909-9a23-c52a51d169a8", "value": "99E4BEAC3250B5DEC857C872CEA81C61E660F5FA571BC7039017029DA90DA9FDFA49F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774791, "uuid": "5a4c0a98-8b5d-4172-b386-1d6b7cad3a3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774791, "uuid": "dfbd72cb-e7e9-4c88-a3c2-89c194f5ab98", "value": "12288:4Aa92iNDGI8wI0gcAsBVeiOiK0g8BFzBdIexUBisfOkcyLm6XkilykfzLv70:m91VGI8wI0dAqVei9KF8B7cVfOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774791, "uuid": "e0af76df-90fb-41ee-87d2-06dd1806c01e", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774791, "uuid": "2e22f701-13f0-4e94-bd69-150b47a2643f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774791, "uuid": "a1e2ea52-1954-4b63-a13d-b4d1776682bc", "value": "RFQ#4734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e5a37c-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774953, "uuid": "429de5b2-48c1-4d4d-bcec-6e597b0ea171", "comment": "Malware payload (Formbook)", "value": "67497732c0a9e0e21981e2a0f73330bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774953, "uuid": "9c311ae3-a3f6-44c4-b6a9-da9b5e8a4c2e", "comment": "Malware payload (Formbook)", "value": "0cec69e7857e687c0352812a4206e68f57008ea07d34b51bb9b1fc44ef042ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774953, "uuid": "3a63b2a3-a777-48f5-83b1-119ac63d7879", "comment": "Malware payload (Formbook)", "value": "b8d77b5d87fe593a03dcbfe30fdb80d46e115c4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774953, "uuid": "39cc8a9d-3fbd-493b-ad78-904cc56fa665", "comment": "Malware payload (Formbook)", "value": "3ea3f24ebef5a69030ad8c5c3fd5bb916d741121b324a42d16f346d6fda22e17813c04364bca2a29db011715318aef76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774953, "uuid": "3f6d5d65-01c6-4738-9436-0423bcad596c", "value": "0B25BF413245DC86D05729F288AFD4612178FDDD9423CB0E2746BB2A64F734A2CDBB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774953, "uuid": "c5ede2f9-6c12-4ede-b387-b6ccf48d813c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774953, "uuid": "c25eb464-119f-49f1-868a-467af7f10fe0", "value": "24576:PLl7h0RjI2Gr+EnKMprooaym6Emydfu7d8:PLl7h022ybr/aymOyp8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774953, "uuid": "ba96afe2-354f-43e9-8519-c189a4d66717", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774953, "uuid": "80c39562-9fa9-472c-b4cd-ff8b4fb53d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774953, "uuid": "9f807a7e-ef13-4213-ba60-9d8c2159fd1a", "value": "Quotation.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651fd4b7-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617768288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768288, "uuid": "a87bcad5-bdce-4c68-804a-e8bac37393a7", "comment": "Malware payload (SnakeKeylogger)", "value": "109954004ffe92eb7e252b0661540273", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768288, "uuid": "4bda3029-de6d-43dd-92a7-c88e7b6473a2", "comment": "Malware payload (SnakeKeylogger)", "value": "0db075831efdcc2f1b83383bf738be83dd15c41ea66c53446de9d3a34dbd69b6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768288, "uuid": "9d369043-5632-46d6-a436-7c2408a1498a", "comment": "Malware payload (SnakeKeylogger)", "value": "05114f6ca2a3b02d0a67948047b7f4c731243711", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768288, "uuid": "1de0c1da-6509-4f36-9df3-67a910188940", "comment": "Malware payload (SnakeKeylogger)", "value": "adabec8d801ca165ea41c6ca817629044a94dcc4510a7133ebd5969b9d6486365611b9d536139f76a99f0b86795d7db2", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768288, "uuid": "7565359c-9354-4deb-8816-eaff417bc1b5", "value": "5415CF6032ACC5C2D17E1BB11826C02013F4B50ED2B6E25E7EDD72A91EB2792C67F759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768288, "uuid": "daae4aeb-bc57-4875-a6ba-0501e2f10d7e", "value": "12288:XQoNjD/46rLI7e+UlzVonusNv1go/u1aSqnmqYBlyAKp:vjz4oT+UlzVuuADnzClWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768288, "uuid": "f6f57e1a-c40a-4e89-a4ae-cf59d0425335", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768288, "uuid": "efdc96cb-55f8-4b9b-9654-922fe18dd295", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768288, "uuid": "67cf3bca-6a4f-4c4e-a80d-af015f214f49", "value": "Yeni siparis _WJO-001, pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07b0b6c-9788-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617789916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789916, "uuid": "6be4495e-febb-4bde-8bf6-8dc9ef2985a8", "comment": "Malware payload (NanoCore)", "value": "b8362f2f6e0353819fa0dd8a35ef6a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789916, "uuid": "d12ac1d2-644e-4d76-9020-b5620743ded1", "comment": "Malware payload (NanoCore)", "value": "0ef41dabaa6af07317dd45595f15625cb7517650bb13b365de0717d3cad26197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789916, "uuid": "b76bf87e-cfd5-41d6-be94-e75ead79d82c", "comment": "Malware payload (NanoCore)", "value": "f1cb392fa0fd6acbb6eb1d858064a74fd5272ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789916, "uuid": "0b83abd9-12e9-41e3-8dd4-477498d76360", "comment": "Malware payload (NanoCore)", "value": "41773aee5d2045278701fe81985fa14c06fbd53a207f4e16603205244b1afd48cef79d9524adb860d9bc4e73d1a3ff71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789916, "uuid": "ff71f721-1acd-433f-808a-561f7c04a073", "value": "B825B28620ECD2D2E029ADBCC41BD3F33396DDAB8741E74631ACF85A656779AD11340B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789916, "uuid": "e29d4571-fd8b-4def-9166-e058d6c6823f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789916, "uuid": "2044cfe8-05a7-42c2-a9df-661fcff56e0d", "value": "12288:5EMXiA97oRAgvitEQ6TFQdNXDfx2EHphAKeZrdhOBcc3:nH97AZfQ0GdNMEHbkhOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617789916, "uuid": "81a863be-c85a-4da4-ac3a-5d9eb601fda6", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617789916, "uuid": "dff9cf09-30b0-4fb1-a24a-a8c863b6f724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789916, "uuid": "be868bc1-a767-4c93-9e4a-e1c0de6aee51", "value": "b8362f2f6e0353819fa0dd8a35ef6a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa64b75-97b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617808195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808195, "uuid": "82bb45bc-976f-4bd4-9f27-ba18a6db5e7b", "comment": "Malware payload (AgentTesla)", "value": "7f56a6231ff0d9850337e180681cdf47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808195, "uuid": "808e1aba-89f2-4e95-b714-62d594dc2f7b", "comment": "Malware payload (AgentTesla)", "value": "10903fee5301077724125dfe94d1f20eeff02aeef5fe2f5f18b815ec3f1fcb76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808195, "uuid": "6a71ab33-d86d-4008-8468-2f0655dc1f59", "comment": "Malware payload (AgentTesla)", "value": "716ae0997d9a29634a7e8e4196cc450e7ee7f006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808195, "uuid": "e658e36c-84a3-4b29-bba0-5be46529e5ae", "comment": "Malware payload (AgentTesla)", "value": "bee8de155ae2884fc73ab71d25ce204c5e1673c1c8a26ca471c8b384019d1ac05c4eac7813f367890716bd48932fc510", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808195, "uuid": "441a53c2-8e48-42a5-84e0-3d12c6caf68b", "value": "9305013D26086F5BE1BD10B902D664402FF09F836997D21A7FE532D91EF17C62B21E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808195, "uuid": "c89416b2-1d24-4152-b245-3046569ad215", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808195, "uuid": "083963b0-cbea-4f39-86c4-5bb0e5ae8646", "value": "24576:xTIVoqCcnKYgHrV9jz5JL/0xi2HUA5fA8NR:AxANV9jtJLIjUAhA8NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617808195, "uuid": "f33f1678-cc12-4c1b-a91e-8b3daa7a9556", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617808195, "uuid": "5797828d-554a-40cd-9c9c-2c7d10fcfb38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808195, "uuid": "39dc6a8c-3b77-41c0-a35a-ba06a721ef1d", "value": "PO_ATHCHEV0035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf05ebe-97b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617807924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807924, "uuid": "08ec22d3-5351-43b5-8f78-1b46365912c7", "comment": "Malware payload (njrat)", "value": "06c25e2b926e368a5736192d8194fa10", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807924, "uuid": "ec7ccc9b-8a92-4e8a-a165-5f07c529a4b2", "comment": "Malware payload (njrat)", "value": "12d1db8cc7a9ab91ed16b33f54cefb4aac4c323d7c2eb078b71e39c1719baa9d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807924, "uuid": "e74cae26-d2f5-4334-bf69-36f666bca243", "comment": "Malware payload (njrat)", "value": "3593065513e82dc78fc729f6eedc321cd1d386a4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807924, "uuid": "58f769a3-3b91-4c02-bc73-245c69b8e86b", "comment": "Malware payload (njrat)", "value": "667c23357f100b0574a32ec85a6891fdfda39d83c7d344991978cb132409f50f73a7ac1a8526cf4bd53f1d9c3bc8beb8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807924, "uuid": "029333e3-0ccf-4ac4-8b96-9e9052ae6836", "value": "1641D8F92FFAC0BAE802AD7853659239D1A9724A350DD62553514D832CB8C930F32A7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807924, "uuid": "7f608bd1-a6e8-4d45-b601-dfe0df2b7c02", "value": "48:9gltgw4tggRfjsgiXF8RrStrHCAGOVYWeeapjYxhrLx7stGIGNExMDsh:ylC1CgfjRiCOwFODatehpYtGIGNExMDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617807924, "uuid": "9cdb64fb-b0a1-4a53-a5a0-d1103fed121e", "value": 2361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617807924, "uuid": "b09db79c-a271-492c-bd61-297adc1f23c1", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807924, "uuid": "0dc021d5-2a36-472e-b5d5-6e8a90d32240", "value": "SKMC25832100083932157.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0abd9a2-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774911, "uuid": "d8e5d17d-eb1d-43de-8559-755f866818bf", "comment": "Malware payload (Formbook)", "value": "2e4785bd10fa399ea41c1eb38fff3edc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774911, "uuid": "87d7a2f7-59bb-4c23-a537-a3a1af7d39ac", "comment": "Malware payload (Formbook)", "value": "1317178c535deac0cd5402fb944ed65542281da1a9d1c4e37c65287d108e6b0e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774911, "uuid": "173c1677-9fe1-499d-ae97-bc868e8f5ce4", "comment": "Malware payload (Formbook)", "value": "467ccc606553b250d5fed135ce62e6d9c19ab9ad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774911, "uuid": "eb2277fd-d2c3-4c61-a0fa-df940996e3d0", "comment": "Malware payload (Formbook)", "value": "622e631ba9c0353c78b235d1aea80f45e3d21cfc6239282d092dea80ba81b7893ce99257c6ee4b0223d112459b9ad216", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774911, "uuid": "4e4c9090-a02b-4d1a-9c7b-f4bb38076386", "value": "B43533B99F9A3FD14BB6792410839030DFE986D27B864A7053AE89257D2DDC3F742407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774911, "uuid": "eb2a2408-a01f-4a58-a190-71d1181a6048", "value": "24576:2QD3S2NAcS5WQnumBYd6LMBWiE2pFBkR3Gjthi:hD3S2Ng5WQnnYBVFQ2Zhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774911, "uuid": "19481063-55db-4ea7-8365-3c86774f221c", "value": 1158690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774911, "uuid": "aeb87ca1-fe2f-4f10-8e35-71a6858a0124", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774911, "uuid": "56f641d3-0db4-47c7-a010-fe97648ea9b1", "value": "taiwan.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81926a33-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617774778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774778, "uuid": "90b47892-bd75-47df-9fa6-596a2201c7ce", "comment": "Malware payload (SnakeKeylogger)", "value": "4847a0eb79fee10c04a5bedec9f759f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774778, "uuid": "fd91abae-f943-460b-b1a3-4bf54a8e0bf5", "comment": "Malware payload (SnakeKeylogger)", "value": "1360731b382e0bcc89d9351099dbbbc972b0562c6d61ead2bdb9680fac7b4fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774778, "uuid": "24de0e8f-08dd-47a8-a8e1-411417c7335e", "comment": "Malware payload (SnakeKeylogger)", "value": "773409d403b2248abbe1b527b2483b87e80d9545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774778, "uuid": "660b4368-48ff-4385-928f-2015807522f3", "comment": "Malware payload (SnakeKeylogger)", "value": "b8ba40bc251ccd87b1a984f2bb265fc8472bd034bdd7f48958aaff031252a4c965facbcdc75ec1c5be42e32707d4c512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774778, "uuid": "a4cbe18f-513f-45af-988f-38ae0a526d25", "value": "45F4D3032EC5C5CCE0D52ABD05F940523F6BDD82269EAFCA96E6736D05B1523FD20A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774778, "uuid": "7c4f46e4-8d2c-41ab-9104-48338344c87d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774778, "uuid": "7926660a-1bf9-4e25-b90d-84b69d229031", "value": "12288:dHV3wYD8uEmPwPMPEpXzoN1D67gDA6EhHiNpnaHqOyfz7lTqrwYr8bKFOW:dFwYDfoUP8oNTkHiNoKbLkrwYr8G8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774778, "uuid": "52b80f53-8581-412c-9cc4-ec781d95478a", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774778, "uuid": "bd491824-c696-4895-a3fa-71b74edbc0fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774778, "uuid": "8f3ba88c-9502-49e5-be77-fa68e26d1cbf", "value": "doc20192910887888001990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba1746e-9781-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617786928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786928, "uuid": "f5a88254-a7f3-40a7-8e1b-a5e457d56301", "comment": "Malware payload", "value": "e0adb146dc231846a1b18dead4acb43f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786928, "uuid": "01bd789c-a6b7-4fa4-9031-12c5b7507a65", "comment": "Malware payload", "value": "13d5c8fc8db531b4c08bd4446e1510a4bef81246370c3932ccd8c4b3954332d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786928, "uuid": "dcb0f469-6603-461b-a518-97b3de47cc34", "comment": "Malware payload", "value": "f0a791a061b34ed18bf2892f6d7224a5f5263370", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786928, "uuid": "53f8d607-97a9-48a4-a927-7861fd270381", "comment": "Malware payload", "value": "8dc8d38b38fb9121232811371200d954975f4e1cd0cc10751b7d18407d6108a836745e2a173147a0c11dcc6629fa08d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786928, "uuid": "f935be8b-4204-4f48-acb6-607911a24d61", "value": "BC05F0213A989F94E43E67760532A42003F6BDAED73AD61D3DDD72CE2B726410663B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786928, "uuid": "6340523b-8a74-4d7b-8f47-8f610945b484", "value": "12288:uKA7C8ratkgFJ6zwBR4x5x7SdpyvkRSLUe8TeW52lrC1XNQY4y1e:1A7CcatJFJ6UqSdpDvSW52g1X54d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617786928, "uuid": "694a5908-bf2d-4d74-800a-a61432d4e97d", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617786928, "uuid": "644ed44c-8e3f-4ffc-9276-eb9b4ef194d3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786928, "uuid": "8ff6d651-1624-437f-ac8a-34f279036039", "value": "Dringende Anordnung 7865421AWB_040721,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4c0133-974d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617764596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764596, "uuid": "0edd8b31-ad7b-4494-ab9f-6410c6f61d09", "comment": "Malware payload (AgentTesla)", "value": "27b0c67e6ea6cf8f4e6d7cdbce818f64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764596, "uuid": "8e98eb86-fccf-47bc-82f1-573465a42945", "comment": "Malware payload (AgentTesla)", "value": "1681babf40425d8edd012d05bc819ce1ef9d48ef55318acc3d29e56a8a649423", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764596, "uuid": "e5123027-a274-49b1-b42f-00816952652d", "comment": "Malware payload (AgentTesla)", "value": "c5256c81b795586c9472a15353e26f72eff9fe61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764596, "uuid": "185e0292-1af7-4cca-8d41-9a942cc6d675", "comment": "Malware payload (AgentTesla)", "value": "28381b2f22b9fdf2029d76d0e107739902ebac09ce4dedb5ae7510cafe440afe1314ae87debf907a144c2ffc3ebcd8a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764596, "uuid": "f81c109c-403c-4f0a-ab39-76aec58703ba", "value": "DEF42396D51FEA7C5B2EC8737F79F7C03388531931A91DA6C3188893832AD520E8DD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764596, "uuid": "411edac4-ff38-458d-af64-f9fd78990269", "value": "12288:igYOMr4QRaPKzyX9WqdURiPWMJjZWv/dwAdnZWVRhcr8l4n4Fin:igSrxzbWURilJdW9won+UQcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617764596, "uuid": "5398f251-9c55-4ab7-b1a0-89103d5afe2f", "value": 724255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617764596, "uuid": "3907978b-9e98-498e-aba8-f014278b2f40", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764596, "uuid": "05316205-13a6-468f-82a4-95ff9f2c73a9", "value": "#100028153.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5749c853-97f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617836125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617836125, "uuid": "f87efb6f-d75f-4691-967b-c1009217504a", "comment": "Malware payload (njrat)", "value": "4b46033a9412f5bb8d2090f02b5cc3cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617836125, "uuid": "e13d8a42-d976-4fd0-be28-fd2aed0ea975", "comment": "Malware payload (njrat)", "value": "178d08d5c67ef2e3da58e326c19a449f1403577189ede8397c3572a7b355232e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617836125, "uuid": "cd5ccd6a-ae22-48b1-87fa-dc7c5fc17f45", "comment": "Malware payload (njrat)", "value": "ed76f424013dfac0476a3a41d3a4ef0aa72fa6ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617836125, "uuid": "6519d687-d989-4573-872a-f8573c620275", "comment": "Malware payload (njrat)", "value": "a7a3de725301b22799289eefbe7d50872faac1d517cee7fa6484c5346fc7d1d57285cd363ab34813a4f7d00973faca79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617836125, "uuid": "45865406-dc78-41e7-9bdc-0b059e50e6e5", "value": "B7C3FA063A4B4711C59D297AC0EF552403F6ABCB6633E65A3F8D6BCD4E023D38E85B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617836125, "uuid": "020712d6-4181-4086-944c-09712d24fcf5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617836125, "uuid": "1bf3f6b9-a138-42e4-937b-c0e8b101c340", "value": "1536:b99eOXimoVAuE4KmLoMyJDrwB1X1kQ4p/uCQDZ0mkSenYi9b:b990moVAH4lhEArf4gCAZ0zSQYi9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617836125, "uuid": "4fe94081-a20c-42d1-ad89-a40bb6a11102", "value": 124415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617836125, "uuid": "68cd5665-2ecf-4a1f-9bb4-3d7f8a3d34ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617836125, "uuid": "5c4f85db-2767-4a81-bf8c-bde9ccf6d4a8", "value": "njrat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5038ea59-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794452, "uuid": "f2d4948a-21af-4e74-8be5-00597f09dabc", "comment": "Malware payload (Formbook)", "value": "e3e7121fb24c058d0c68ee554fe0f530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794452, "uuid": "b9e42460-3342-4286-acbe-e2d09ad88e64", "comment": "Malware payload (Formbook)", "value": "17c1d72767fb09f83c78e95a4e3f0bc7ed2db219774cc1e55b0391e2604a8362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794452, "uuid": "7ee46d72-c089-4d2d-98a7-5d74073e13fd", "comment": "Malware payload (Formbook)", "value": "9841730061ae158e59c039269c75b1bcbdab92d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794452, "uuid": "875ba3b4-5228-4655-bc1f-52e661faf05b", "comment": "Malware payload (Formbook)", "value": "a26e5d6a6a665e6eb0c27702fdecd1dc0504c2d33ec6400dbef2300c2a7a92e63be865c94a7abce9413b01b6850643eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794452, "uuid": "9b3a46f8-ecf0-4eb4-ab58-49e5e801ee6f", "value": "DE05F055ED805AD4CE2D93305E7BC87907237D7AA4B4450C20E97F773BBBAA3002AB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794452, "uuid": "73def43f-10d3-4ade-bf09-83b445c062c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794452, "uuid": "90aa7d56-922b-4f37-a919-9daeb657afea", "value": "24576:wk33bbjQehAmJFWhyOvu26/irEaW0iUuyq8a9:w0rZA2xO226/kBuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794452, "uuid": "7257b012-9aac-42c4-8d9f-ff78540e12b5", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794452, "uuid": "3cc7201a-3559-43f1-9000-32b0da0994b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794452, "uuid": "dad791da-7816-42d0-9520-172ac9858793", "value": "INVOICE for Order PIEX310113978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff1569e-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774936, "uuid": "906da89b-63ad-4d7a-ba7f-cdbf1cb9e04d", "comment": "Malware payload (AgentTesla)", "value": "6048f1059131a6c980fdba17c9053818", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774936, "uuid": "261193c8-7dd9-49a0-8ca6-0329fb1573ba", "comment": "Malware payload (AgentTesla)", "value": "180ecd0e9a58eb360d20333cbb0778ef8bdfbd31a1512b257256bf850dd41ff2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774936, "uuid": "ab463baf-cf50-4639-b9d9-c06ea2118757", "comment": "Malware payload (AgentTesla)", "value": "1240913fada84a92e467e238d780f4e1b6df6915", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774936, "uuid": "9e34db78-913a-45d8-a94f-29eeb0d43600", "comment": "Malware payload (AgentTesla)", "value": "c7b29bb7621115f3dc525112cfd180c75b4c6bb212c1308f6e764eea7d10ce0276e9c2b9d21b6faf3c29b6ace7cfdb55", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774936, "uuid": "b5b6621b-8250-450c-bdd4-4c79b9345533", "value": "94F42385C49EEA7BC806F93685984023689F30146830F08ED7B5F0693D97AEDD5D3E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774936, "uuid": "036ebb7a-1896-44ec-a575-ca153f10c3c3", "value": "12288:l2kaH0uhvOJkuweWfKYa0c5Xcc8fMyuutlnabLPs/lSTSuU7njiVVqgZM+yd:K0uhvewNfK7dXcc8fMqjlSZU7nBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774936, "uuid": "f2cc1e11-856e-486e-8a00-8a455dd55ec2", "value": 746908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774936, "uuid": "5d523d2a-4e87-43fe-8467-cfff4287feaa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774936, "uuid": "10cfeef7-9a77-4742-a6df-624a451b6280", "value": "PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec967cd-974e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617764761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764761, "uuid": "37dc9d08-34ca-4b1e-b2db-759378b01988", "comment": "Malware payload (AgentTesla)", "value": "5467650320b9dbaa57384157c5cd83c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764761, "uuid": "89178c6e-39da-4dd2-81e8-dd3c0f502835", "comment": "Malware payload (AgentTesla)", "value": "18eba2262747edbd2289fc90d8ee8a0b1b4f23866093906f1c4eed5c92150cc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764761, "uuid": "7a7708f1-fd0a-4cff-9c1a-c3bc4309eb66", "comment": "Malware payload (AgentTesla)", "value": "96f780c9f778bb8559c9f9015b5806223e9f554f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764761, "uuid": "769fbe39-e665-4837-a86e-9f9f03562688", "comment": "Malware payload (AgentTesla)", "value": "28706c18cef951e3192efa1ee9145e001c0603c93e0bc785d32663aab9475ceaa9fb14e267b8869906070f96c2cf5251", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764761, "uuid": "aa5fef06-32ab-4e28-9252-ce2614996630", "value": "66E4235731F912423F21279DBB68D937E8DA135D34FF27AC921082828A567E35C6D8B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764761, "uuid": "6182aa4f-f4f0-46b3-83a7-b7ff2a35c634", "value": "12288:kpS2ipcHUIg7SJakrX1ad0wMzhspS9LYcZVFSMKWT+Mtk1O+4iUI9TRx7e5FzL:kpS1aHi7SvX1JtgSvZVAMKWvk1O+4iUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617764761, "uuid": "c029126c-7c24-45b2-9c2d-8f26a27b79b2", "value": 674390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617764761, "uuid": "f06114b3-8e5a-4e72-bd27-7732f47ca092", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764761, "uuid": "6ef9ec78-2e49-4a1a-bd70-027f657acbe5", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23a7689-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617768525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768525, "uuid": "06c5c598-b8c3-4a9c-aae1-e05b1e3315e7", "comment": "Malware payload (Formbook)", "value": "ba55a21782837250fcdedc578175c874", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768525, "uuid": "212e6cc9-ef01-46d1-8458-7a280b5ac23e", "comment": "Malware payload (Formbook)", "value": "1925c407d4f24ed0e1e002a57042e4cec58f9e09bde7c441f6f5b9ca5748ea20", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768525, "uuid": "51008ffd-f025-4729-b9fc-8115f4253a4b", "comment": "Malware payload (Formbook)", "value": "539a65f405acb7d5a1ba4fb3ee7dd0fa75bab33d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768525, "uuid": "25a60bee-965a-45b6-8663-a37ca97c5f5d", "comment": "Malware payload (Formbook)", "value": "dcdc426ceecd9514377f565279df5da851cf0d770b25e3bb869418b725fc5d820d94c7494c41626b5a0c98ffe36dd9e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768525, "uuid": "03316511-c60d-4e18-84a6-b69dea7e4512", "value": "9344CEC6FA8095A5DC2A9731153AED3196133C3C90B42A1D2BCF7E7B3FBB852941A453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768525, "uuid": "52b7955b-bb43-4c65-b93d-1351da1f82aa", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768525, "uuid": "1abfc75f-afae-4bf2-9346-ff86c6369bb6", "value": "3072:6eYBCwqDxkJkMNum9vpXy156lWydd48NwFIhLbJnNO7MwIBYLrhjawzYj26f5JZ:6DIfIX9vJy12Td5NJncIw9pjaK6f5JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768525, "uuid": "f9e4260c-6a89-4ea1-8036-d60a48183226", "value": 273265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768525, "uuid": "63ebee87-147a-4146-8d40-660877244278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768525, "uuid": "9b7b3717-1d2b-4348-9bd8-f6e65eb23cfe", "value": "DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db76156-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794529, "uuid": "16d03570-f4e0-44c5-8969-773c2f4502c1", "comment": "Malware payload (Formbook)", "value": "eeb6f7be3f8d0565e4ca949e0495afb4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794529, "uuid": "d83ab96f-fc2e-4832-bf13-56f8abc95b35", "comment": "Malware payload (Formbook)", "value": "195dd35f4cb67366ccfa4172d8c9165617b13b4e35302f57d2e4107f9651c2dd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794529, "uuid": "b96a696a-0b90-41ef-94cd-6fd8a5cc7205", "comment": "Malware payload (Formbook)", "value": "6fd12371e583e62152b209764b13c4d5dea2530a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794529, "uuid": "37c33e96-ce58-4b80-88b8-bb25cc85f79a", "comment": "Malware payload (Formbook)", "value": "dcca8d460404c62171f0a230a61c036cf861161a7ca376d5c05abe2a4e16c883d229107d1c5221f1778b041ad21ac075", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794529, "uuid": "7e78651f-0d95-4641-ac59-5a730b214a9c", "value": "1DD4230084EE94D02EC9EE031A2EC3B6EB2B73935F7D9EBCC5D31669242750E4D61E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794529, "uuid": "8066160e-5dba-4f11-b762-065ae03bb6ed", "value": "12288:ErLCFpFuQI0bt33BbB1tQjyudbo7SxhtyIrxEGbczEI:ECFp0QI0btBbB8smHw0xffI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794529, "uuid": "ce8d3bee-7952-4852-8060-9932cc541aef", "value": 612807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794529, "uuid": "929df5d7-801a-46c3-958f-6762ec9f360c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794529, "uuid": "b33b37e1-4fef-4da3-8a72-4b36b89d929a", "value": "Radix Pvt Ltd - ME1-PO-20-2690, FUL-015.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013b1fe8-978e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617792172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792172, "uuid": "3ddda5c3-8f91-4014-a69d-3275cd26a41f", "comment": "Malware payload (AgentTesla)", "value": "1fec2d5b034782114f98b49cab1c90a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792172, "uuid": "939ecaee-31f1-467b-9f48-72ba101a2868", "comment": "Malware payload (AgentTesla)", "value": "1a5421663abc706ce1c326cd443f5aba56108c99ef8e885261366aabf2e2f915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792172, "uuid": "dd2479c9-e974-4b3a-adfa-a5ae279ef2c9", "comment": "Malware payload (AgentTesla)", "value": "e25c741c949f3a1479a76791f8ff18251eac3385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792172, "uuid": "27484c53-307f-4b31-b233-3d30c857e67f", "comment": "Malware payload (AgentTesla)", "value": "05df2b1314cb95e5d31412c4d9fa95092954da93b84ee6ce04696cc68e871b72ea4130f4db79d1fb6ce7889b33489d00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792172, "uuid": "d15a1a8d-0c3c-46a7-aeaa-80d7eb07eee2", "value": "240501207385CF11C8A507B2857385834379FCD8B813EF6A1A58B2DA3836B5C9DDADD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792172, "uuid": "40de15bc-ac9d-426e-bb88-f4c7332f3b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792172, "uuid": "93247fc9-61d4-42ca-9618-60e72105066a", "value": "12288:9JXlv+yzsj6DteKOW+oocBDIpDHgh7d1pIm1Xn86PPFcB/alW4l2++pWvVBnkwY:jXlWhmsKcq1ItAh7DmWX8sTO+hTnkwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617792172, "uuid": "8a4baf09-8ccf-425c-bf76-cd45b15f8876", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617792172, "uuid": "ee59fe52-74b3-48dd-b93c-8e2345aed09a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792172, "uuid": "64a917df-8f18-4761-9557-11771f125b0f", "value": "Agency Appointment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1f566a-9774-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617781297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781297, "uuid": "773431bb-b27d-47d3-9000-af5419010e06", "comment": "Malware payload (Vjw0rm)", "value": "4de17c31c52ace96c8edff9a1fe84bb9", "object_relation": "md5", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781297, "uuid": "55c2ee08-92d8-4048-8fdc-d2fadba9630f", "comment": "Malware payload (Vjw0rm)", "value": "1b4953d6a657481dc7f2c1e372361086dc129e00dd5c8977c84ab25e7bff958a", "object_relation": "sha256", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781297, "uuid": "d8bcd87b-3fbe-4161-87a8-e0a676174519", "comment": "Malware payload (Vjw0rm)", "value": "f82633370512c8d31606b27a0b3021e7b7828591", "object_relation": "sha1", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781297, "uuid": "8ca3a4de-0aa0-4e4c-887d-95499e811b5d", "comment": "Malware payload (Vjw0rm)", "value": "0a4f9b5e966b9df5e4cb1057efb89285fca05fd187494c8709ecb200dc051828fe3f9afdbd1cb8cd32da5ccc10e6ad4f", "object_relation": "sha3-384", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617781297, "uuid": "b27fc629-f686-4828-a153-143c73c93f39", "value": "27D24889B6325CAADE87112A543B2F7BF4D36C8153CAE15DC4CFEDDADB1A81291010DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617781297, "uuid": "cedffd32-c3aa-45e9-9af0-a5ff50e588bc", "value": "768:BrQbK4iuSmcrRY/4gnuo+OCmuMbpt8wif0X:BrUhiMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617781297, "uuid": "6e37cd4d-02af-4745-b7be-32036b274ab9", "value": 30732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617781297, "uuid": "b33a5dea-5cc0-4c35-ba26-9251421c5e2f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617781297, "uuid": "4ff878b5-12ad-48e1-b62f-7d1df7567fe9", "value": "ID46032997132.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78f8d46-97d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617821657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821657, "uuid": "7cbb2452-94a6-461f-804a-c807478bf1c7", "comment": "Malware payload (Dridex)", "value": "248220433b2ad5f396807db9a52e8750", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821657, "uuid": "da744bd1-12ae-4c00-8ae9-bd5d9b843a87", "comment": "Malware payload (Dridex)", "value": "1be08b677c8ca30c80d901791d76470611517a03f0b826354952f98d61d0cd16", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821657, "uuid": "449095bb-662e-4106-876f-6b357bbe40cf", "comment": "Malware payload (Dridex)", "value": "2f1ae33faf39a66686cca1efc5a82364b78dcc54", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821657, "uuid": "b122bc6d-d598-497b-b241-8967b8fe2804", "comment": "Malware payload (Dridex)", "value": "760a72e36917a72185f01d37285e3e87c70aaaa6d4162fdcbe1088460e2571912d2c8b58a58d9b44497cb09ba7b44d74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821657, "uuid": "da4de0b6-67a1-4747-8084-8250c2e4645f", "value": "6514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821657, "uuid": "90530b10-e862-4414-b82f-14989f2df6d0", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821657, "uuid": "4a176f0c-8c62-44d5-8e73-e4307927a462", "value": "3072:xBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:xBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821657, "uuid": "9cc9c9e6-2c9a-403d-907f-0ea58308e251", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821657, "uuid": "d95cf714-579a-480e-952e-49ca5d64c947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821657, "uuid": "5f2c64ec-b683-416b-a2b8-85e155bdf9cc", "value": "1be08b677c8ca30c80d901791d76470611517a03f0b826354952f98d61d0cd16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e790a1-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774817, "uuid": "8872ccb0-469b-43b8-823b-d280adc23eb7", "comment": "Malware payload (AgentTesla)", "value": "39a5a52bd0138cb973e646915bac0303", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774817, "uuid": "da4dc2b7-cbbc-41aa-803c-516309d898c1", "comment": "Malware payload (AgentTesla)", "value": "1c20e81106455f9fb194f0eed281aaa0f48169a728f73b7b42f0d4bec7fbcc32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774817, "uuid": "cb5c8619-da50-45ff-8768-84b759e57ae0", "comment": "Malware payload (AgentTesla)", "value": "34f583426b70d2776be3a669da9c60fe8c63f8ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774817, "uuid": "45a4f6f4-3cb7-46df-a1cc-8ef1616ea5c9", "comment": "Malware payload (AgentTesla)", "value": "13e1dd68d1d008be549388abf7b0cb5f69fd2ee7a7c7e674c98a791a6e9227977d67f7499d4f5504bad1095048e22f86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774817, "uuid": "3882bc5d-f147-4d3c-8422-2ec59ab14701", "value": "53A4D0D5B737A90EC2480F3BE437587472FA94267127E32FE8F876D50836689463A913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774817, "uuid": "0ed13267-4d51-44bc-813f-35ccfca6478e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774817, "uuid": "d3807ab0-2da9-47da-bd34-9b2731f60432", "value": "6144:aevtgDeOigwm6nVAN8Uc/n6r60/VDUSY4tuRdv9yVjfaN5MIIgtnzKXGFYnV4hf2:aOtKpIV1Fn6OAVo1T9ugAWhf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774817, "uuid": "2b48501d-0c0f-439d-acf1-227ba86e98fc", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774817, "uuid": "fbe080a9-3fca-4276-adf1-3bb3bccb36ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774817, "uuid": "ffe1cbb3-15f6-45c2-8fe6-006acc133b43", "value": "Thalesnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb93b921-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "a9e5c333-fcc5-436e-9f43-3502e6d06d68", "comment": "Malware payload (Dridex)", "value": "51d9fadf64b6c30b3d8c8b74d53d8632", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "f797cba0-16e9-4809-8bcd-8082dbc3bb2a", "comment": "Malware payload (Dridex)", "value": "1cb37dbbc5e656256ce242dc51d9a213366ab37952a65b1cd0e1296dc0c1e8ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "be0c3b58-61a8-4d0d-b019-0171fbb618db", "comment": "Malware payload (Dridex)", "value": "c6fa133cf1029cb293af5f2d3294cd6dd23927f1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824375, "uuid": "a6e0434c-9eb6-4f33-952d-a802e491e752", "comment": "Malware payload (Dridex)", "value": "17c23c397cfb5ff4108fe1b6c8a45ce838a4674399cb36400cca4e8faa352f459b5e8d44d7101cf7c9cef0077298147e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "a9526f5d-95bc-4304-8ce5-a49a3353db80", "value": "B1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "195e3539-7a6e-4883-8c42-7e89eff2482d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "f9047915-c09d-4214-ace4-58080c3a5ae6", "value": "3072:90DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824375, "uuid": "ade0ae47-d1b8-493a-b0f0-e058f68ec5d7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824375, "uuid": "1f292162-bc9d-4530-bb8e-3bef2cbcf2b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824375, "uuid": "b1886fef-9863-4031-a94a-d83d34bfbb47", "value": "1cb37dbbc5e656256ce242dc51d9a213366ab37952a65b1cd0e1296dc0c1e8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6f2993-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774853, "uuid": "52fce88e-9309-4bfc-aa34-108f608068ed", "comment": "Malware payload (Formbook)", "value": "910629e4fdd52fddb024a200d6601685", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774853, "uuid": "ea65c539-25fe-4c49-b5c9-ebd78b134d15", "comment": "Malware payload (Formbook)", "value": "1cc91d252bf82ebdfdf366301f8cd202b708dff339bd03d30ffdd7595b52dae4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774853, "uuid": "1f1237d3-be73-4eb4-839b-5969821f7486", "comment": "Malware payload (Formbook)", "value": "0476c3983a18d650e26212b56e6fc54338e8c5ca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774853, "uuid": "4a1a76cc-3426-463c-8afa-07dc1236f86e", "comment": "Malware payload (Formbook)", "value": "066ddcca9d15cf7c8f8e0c56561b3caa8a7089cdd14ed7ee353fbcd90eb0af3fd4a7c4495ddb13e980549e54c0814784", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774853, "uuid": "1b9ba50f-100a-400c-93bd-2cbb7b60f18e", "value": "93A45C823184DCDAE04329F248AFD57061796D9E8165CA0E374BBF2B96E7343245F78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774853, "uuid": "2be7914a-b6d7-4d9b-9960-48457a4b839f", "value": "6144:dDIdstvLGtELbMUTKZp3+3lb8I80AEdbCdin9j:KSityjKb+398T07MQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774853, "uuid": "c3389fa0-7733-4b1b-836b-ceece08eb479", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774853, "uuid": "cdeec487-dcc1-492c-b452-db586a51124e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774853, "uuid": "9be48c15-5e90-4192-af45-6cfb65ff8244", "value": "RFQ_AP65425652_032421 v\u00e1\u00ba\u00a5n \u00c4\u2018\u00e1\u00bb ,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f088793d-97d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823927, "uuid": "29527eaf-3b5d-451e-a078-dc039857d5f3", "comment": "Malware payload (Dridex)", "value": "a725e92e6f787fed4ba92bd7883e7c53", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823927, "uuid": "6f55c0ca-b4c5-43c9-aaa1-121b76e85b96", "comment": "Malware payload (Dridex)", "value": "1cd126dff718da69a1398a21bf13a8439cca283a2db09820d0526cf867ea9e24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823927, "uuid": "3d1e8cb8-ea73-47e6-921e-d286eace8f5c", "comment": "Malware payload (Dridex)", "value": "caa1fea01975dfcd67896eafebde4c7190c9677d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823927, "uuid": "cf7fdd56-6bc7-4566-a4a7-c39ba50022b0", "comment": "Malware payload (Dridex)", "value": "ffa4cfa827f48e7e03b725f56a0f466235abe1f5ac49caa2fe3cefd4c5000209bf36d3eabb654c7b1da9caadf76a7bd4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823927, "uuid": "e59ff164-fdef-4f43-9019-b437b93343eb", "value": "E8249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823927, "uuid": "20039e1f-ca60-42be-9f11-475ea0f5619b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823927, "uuid": "d3bc9971-0884-40a1-b381-df19601d3f9a", "value": "3072:b0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:6pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823927, "uuid": "9beb8ab9-6676-4244-98d4-85852c1898b6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823927, "uuid": "0654a34b-04a6-47d4-8b89-684c19ee7627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823927, "uuid": "799e8d40-fb04-401a-892f-b15251d75013", "value": "1cd126dff718da69a1398a21bf13a8439cca283a2db09820d0526cf867ea9e24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168cda60-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794355, "uuid": "383f014b-1529-40a3-a859-a6fcf3fed052", "comment": "Malware payload (Formbook)", "value": "26beece36b944dac9fb86d072048fe45", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794355, "uuid": "94e01021-629e-4e5a-8c6d-9ce4a9e71697", "comment": "Malware payload (Formbook)", "value": "1cf4a440f09eb870ac2eee86adbc4d74044d1be260d379ccd4fce3b8e0e3df6a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794355, "uuid": "9ca3ea6b-6191-4797-bf7d-1f086b622766", "comment": "Malware payload (Formbook)", "value": "1e4be3a573029b5f866a19ed9c22e9d91861944e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794355, "uuid": "225b832f-6352-4f22-acac-d2ee61742517", "comment": "Malware payload (Formbook)", "value": "fcdf0ea0efb10e58017be376f18d0e36e898f8c38193dec602a8ff0ce0775284e3d13492a1fd399e050b39072aa6082a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794355, "uuid": "88c53963-f10d-4aa3-8b50-190caed70723", "value": "EDC4234B672236B934F3ADFE41491760C9E69B0E6EE28EF04C734535114F9A64FA24F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794355, "uuid": "db9286c1-c5b6-4f9a-9a92-e22ad47c18d1", "value": "12288:XGX7MnKLlYji9p/qpS/uXeEGkvICloLMia3EpF7ZqTmw:XGXEklGu0pS/uuEZvIoX3EpF70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794355, "uuid": "18bb27cb-78ee-4924-b9a6-35cfe9e5e922", "value": 545654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794355, "uuid": "967f0016-cfb5-4022-b183-4c0bb2da94fd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794355, "uuid": "6588c909-8ab9-43c0-95f5-106d9b0574f7", "value": "Export Invoices_Packing List.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b087e27-9798-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617796671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796671, "uuid": "eea2d80c-d451-4e65-a655-6f4c058c1fe2", "comment": "Malware payload (Formbook)", "value": "6324862ccd183522472fedbe3901d267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796671, "uuid": "1098d3ef-21e6-4436-8974-9e0433aa8ea9", "comment": "Malware payload (Formbook)", "value": "1da66787bac6e2293792bf1f2d262c9d587b1fb63084ec6afff294b79c208014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796671, "uuid": "02cdaf9f-2ad8-4d7b-8a4e-924460248175", "comment": "Malware payload (Formbook)", "value": "46b1718671e662b34d903eb9acf2cc09ef893ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796671, "uuid": "5ce2695f-d2a0-45e0-bdc3-41d5cdc22e1e", "comment": "Malware payload (Formbook)", "value": "805612f2fbf12fcccc52e984da636961e3fe648f03c05c04786bd9605b1a3bc54467e5de870222eceb7fa4398f873cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796671, "uuid": "89b9164b-6875-49eb-b13a-378642006d4e", "value": "B20501212B988F94E43E6336053654A047F1BDAED336DB1E7DD8B1DE2A32A145237F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796671, "uuid": "647bbdff-202b-46ef-9063-f097b6673655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796671, "uuid": "f0fd5875-2873-421a-9a61-ae93c903df68", "value": "24576:IehAesJPxtoGyiI7bMQVtbl1wm9YL44Mwv5N:IehAe0toGqbMQVtbl1wmuc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617796671, "uuid": "b8ddf83c-f95d-4140-b408-46bc475247c3", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617796671, "uuid": "565463e1-0999-45b5-9502-a25c0b29951c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796671, "uuid": "82ba46e6-7af9-4f9d-a0e2-081b0e36d810", "value": "RFQ_AP65425652_032421 URGENTES,PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242a6810-9792-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617793949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793949, "uuid": "14029ff7-0592-46f7-8fd2-616385a1f7a4", "comment": "Malware payload (AgentTesla)", "value": "b5f9c5223a6cbf2328ddd01835ae8280", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793949, "uuid": "2f70e38c-0075-49d8-90c8-4a5776077d04", "comment": "Malware payload (AgentTesla)", "value": "1dec762da4aa7fc39d095862cfe7b7b323dc799c3e57a2cc1a37d3efdce2e674", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793949, "uuid": "d68d6952-c089-4715-8bf3-91e839bfc7f3", "comment": "Malware payload (AgentTesla)", "value": "d292f759ac92e5beafb0aefda4b2d3a70d2611ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793949, "uuid": "7e491757-0e09-4a2b-8b88-9330b91dfc13", "comment": "Malware payload (AgentTesla)", "value": "fd299febee77d52bcf53ae41fb873f3b7db8ec996b7085dc78fe2091998510972308e5ea385f3174e180d1e5b69e7032", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793949, "uuid": "6dd66042-2682-406b-a779-868bb37db12d", "value": "9FA4124939E05F0FE663B03917B59D693022DD26124FE09BB23979FC2979306F982743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793949, "uuid": "fa4bd522-3059-4d34-81e9-c938010d9fa0", "value": "12288:ZJ5IUeo7Q/Web0y00gZEqV9oMqbfwGd4ggh86SiUjUAwnFFGWFX:ZJ5Je4Q/9QNZZuXwGd4gPJIAU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793949, "uuid": "0f52c600-e26f-45f2-b1c4-b84b0cf92c1e", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793949, "uuid": "414d27ef-28fe-48f7-9b87-27c8fca548c5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793949, "uuid": "21ecbfce-1071-4bc9-852e-32a6efb17848", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce41d00-97a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617803573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617803573, "uuid": "0134d390-e84c-4cdd-9579-e66dc13e4744", "comment": "Malware payload (SnakeKeylogger)", "value": "34dbcad2cb5a67714aa358f41f26bfd3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617803573, "uuid": "c0df3384-a261-4504-9ce1-e04c21f94f60", "comment": "Malware payload (SnakeKeylogger)", "value": "1e204091397d6ca9def2136e328a4c2d4dab11839a2674b4b938fb7931ed2b50", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617803573, "uuid": "b4306d0f-4f0a-4378-8f5d-2dc8812ea15d", "comment": "Malware payload (SnakeKeylogger)", "value": "dfb843c36cdf01c4b5b162883ac5d3d27d6a1576", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617803573, "uuid": "32d4823c-cf92-4abc-bc71-b290436f9690", "comment": "Malware payload (SnakeKeylogger)", "value": "84f6a67545a950380655553ac31775f48af8265298f1189a51627cec89a7abbbac6332d5e793e284396745f3d1d403ba", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617803573, "uuid": "fca7174d-9f20-4b1e-bee8-147b7c3646e9", "value": "1573895AB8C8C47DE018A5B148527C7127785801FC939CAE990CD4E12B99EE0AFDFE7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617803573, "uuid": "315c0dc9-644c-46ca-a66c-b10aa946157a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617803573, "uuid": "c37f2ad6-b9b7-4c53-b4a1-9a6d67a44768", "value": "1536:XyAKGAtwwAR9t+ZWTUWT9WT+WTOWTBWTZWTcWTuWT+WTXWTlWToWTnWTPfPppfk4:C7G3tVfPppfkfmfF0fzf6pfpfAfTfFfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617803573, "uuid": "36584cc0-d579-498f-ab1b-b3792c460bf5", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617803573, "uuid": "7a7b71d6-976e-40c1-9790-c33dc1b320be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617803573, "uuid": "20158475-7793-4efa-8ac9-28170dd55c14", "value": "SecuriteInfo.com.Artemis34DBCAD2CB5A.27289.31741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8a8925-97ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617805452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805452, "uuid": "24f95338-b6dd-47b8-ae3c-57cc77616b9d", "comment": "Malware payload (TrickBot)", "value": "3b293561854d9ad8d99f8cf2f37ec521", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805452, "uuid": "5cd0323c-1546-4138-92b7-d3e52934db66", "comment": "Malware payload (TrickBot)", "value": "1e472b9de49871cbf3a381b560312a55163a196213329fdae34f4bbae6dd9d20", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805452, "uuid": "cbc9bf11-4110-42fa-aa5b-3de362d618e9", "comment": "Malware payload (TrickBot)", "value": "96c0e80d1f801b294cfac4038df584f83b637fe2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805452, "uuid": "a1cf4e58-acd7-4f92-92dd-714695c8ea5a", "comment": "Malware payload (TrickBot)", "value": "1e6f4ff9d94c918c619186e2b3a20943725e22da2b712d61545da91f541afd112818347ab182f3ec254ad9a01757c126", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805452, "uuid": "cbeccd59-a121-4928-a980-e9aee699cf87", "value": "6BE3AD03B688DF22E12952FA0E87CEF8365A7F459E41C2A731983B5F7E745600986B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805452, "uuid": "1d528200-a479-4e0c-8e9f-20d627e02ea7", "value": "3072:sBFS6igp+dDroFMky3zbcNXg+UiGMr3KKJ+:sBY6igpCiUzbctGVMrKKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805452, "uuid": "8d842cc1-6c76-46bf-95cf-e0d2f06fefec", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805452, "uuid": "526d87d9-c8d9-4732-9c9f-02e6737fcc40", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805452, "uuid": "57346a66-d502-4d5a-af69-59930e4f96e3", "value": "Track1Z16301.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ca8fdd-97d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822303, "uuid": "ac7f0a21-18b5-412f-a597-3f5f88465053", "comment": "Malware payload (Dridex)", "value": "768a667b95b351e8b7ba4d737581fa29", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822303, "uuid": "acfac3cf-9756-4613-86c2-0eda9a024c63", "comment": "Malware payload (Dridex)", "value": "1ed7e20d01aedb8ee972dacfc54cbe538397f09965850b1a25b86054192d7659", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822303, "uuid": "a3b9b252-f602-4954-a75a-694bc3f64603", "comment": "Malware payload (Dridex)", "value": "0b8e4c88da672783ca452978733c6798546c9933", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822303, "uuid": "d7ae625c-307a-4e11-8669-d8da8fa2fce3", "comment": "Malware payload (Dridex)", "value": "f67147df33c1308519bb0a8359d76c2d8c897b0547a50d93a1312f80d68d2421a6a61f11a2c4a648cefb462944c9e5ad", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822303, "uuid": "a441165d-b751-44c3-88c0-bf98d3a5db1a", "value": "4614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822303, "uuid": "9059d116-2e5d-4e51-8104-25a3a8fcd537", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822303, "uuid": "39ad6bad-d187-421e-9830-02a615554f61", "value": "3072:9BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:9BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822303, "uuid": "e34ffc4d-a2bf-4b1c-bb1c-69c020d547cb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822303, "uuid": "ce2a2092-9421-4102-b480-bac069dbafb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822303, "uuid": "280abaee-8e3a-4679-937e-d52a7ead6dc1", "value": "1ed7e20d01aedb8ee972dacfc54cbe538397f09965850b1a25b86054192d7659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fcc891-97f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617837323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617837323, "uuid": "cc3b8f9f-377c-49c5-9615-25046a6eaeeb", "comment": "Malware payload (njrat)", "value": "ad0e6e862174f66c4168dba63e20b0d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617837323, "uuid": "7df1858f-334a-455c-824d-021825731ffb", "comment": "Malware payload (njrat)", "value": "1ef96aa5d57046324c1a82ceb588e72795d060f2ba9942d0bd17a2a5c8fd7dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617837323, "uuid": "84ab7d4a-36de-42df-92cc-448d2cc3131d", "comment": "Malware payload (njrat)", "value": "cc118e9da80e4ff2a95f04b44a2a238bb1b982a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617837323, "uuid": "e8ea4497-fd73-4c34-b317-f67a6d5db00a", "comment": "Malware payload (njrat)", "value": "37bb1407d7373f2edba029a9e6ed0193754d7a7485b6a9b0043dbf44dd0df6932c0052f73091b4947452689fb5108834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617837323, "uuid": "b1808b3b-f1b6-47aa-a1c0-a30aeb2e5c61", "value": "CF33F161EB7D7B32ECCACB7D5627C6E1E214B1EA61BD651BCE9417943C72304021B024", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617837323, "uuid": "1e50b099-24c6-4770-8363-88f636d9f2da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617837323, "uuid": "b183a9eb-72e8-47d1-8bf4-cf302d5a2059", "value": "768:0mol+01mpVhqOUFZtIHMZQSPTjYsUF8vYnf3jOo9uBf2E:0mv0xFrIHMaUUsUWvM/jO8uBuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617837323, "uuid": "5968c3c9-f1af-41c2-b29f-188322a90f2b", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617837323, "uuid": "1f06c97f-9fa0-4675-b2b6-f1f479a9f96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617837323, "uuid": "b4674f33-f8b5-4699-9e37-421570d93782", "value": "AD0E6E862174F66C4168DBA63E20B0D8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd8796-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811108, "uuid": "138729a8-d354-43a0-80c1-7c1f3d0f30c0", "comment": "Malware payload (Sodinokibi)", "value": "c6204ffe292f62c30e8989ac2c043c14", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811108, "uuid": "b5ef8e5c-6794-476c-8328-eb853136e449", "comment": "Malware payload (Sodinokibi)", "value": "1fb2178279b76d9ed5e3c24b24885a31ec521e58a4688597600d26f88df5b8e1", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811108, "uuid": "24dc014c-6c28-4b31-8fb6-195cb9f0c9cc", "comment": "Malware payload (Sodinokibi)", "value": "5d33ee9f1a2ceeece14db067b1c841980915d47f", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811108, "uuid": "f02daa0e-1567-4de5-8d63-8687a80ac0c3", "comment": "Malware payload (Sodinokibi)", "value": "a1e9c58ccea9f82a5a26e7f4cd8ac8f66b89c356eedf1612fe6c2e4617b85c8a8d495433ebd57a307ab8212987bf3156", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811108, "uuid": "afdc1446-a700-4ce5-84af-390b1c9e511e", "value": "11C3CF63FD9042B2C98381F6033F3F17EABEFE361814586BE36049845EA51D1E62A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811108, "uuid": "1d588a1e-9e09-45fa-b0f2-1b693542e90b", "value": "b321b6896e18906d7c1d33f3e88fe16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811108, "uuid": "53f011a3-81f6-49fa-b30e-b62ef9645b4a", "value": "1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lULJ8pLwEt0TXij:mmV1wKdLoLC/OemULJ8pLj+Gvmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811108, "uuid": "c8a8287f-c4bb-45f6-ad7d-6b75db8ed449", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811108, "uuid": "8188564c-84e3-4ef2-b8b9-38030c3b1862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811108, "uuid": "cc00afe9-af60-4a82-9184-ec2fd6d2b5f7", "value": "1fb2178279b76d9ed5e3c24b24885a31ec521e58a4688597600d26f88df5b8e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6a6035-974d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617764599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764599, "uuid": "6a1e02fa-07d9-4ec0-a154-f0a8de3130ee", "comment": "Malware payload (AgentTesla)", "value": "f2091a8edc2c840635abdf9c0dfeb123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764599, "uuid": "daa0bd33-0d3a-4d73-b9ce-01b4934fadae", "comment": "Malware payload (AgentTesla)", "value": "1fcdd3e4723f498ec7e20fddc287aaddc0ac8858efeaceac6e098230b7efef9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764599, "uuid": "d6a54ac2-807a-4603-8bb2-15cf8a041d3c", "comment": "Malware payload (AgentTesla)", "value": "4c5489b3a2069b33544467026defc56c0d8a7dd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764599, "uuid": "2f5da396-48d0-42f0-b079-8285c9781974", "comment": "Malware payload (AgentTesla)", "value": "e8c2e2868620d8b742b230db6f4153d8ccbf9417c3c906a52d4af57fb30d2cfb3a0c779f04ebda73e1048ae5f0ff26c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764599, "uuid": "5ae55d08-4c8c-476a-a1b3-9fea2cdbed32", "value": "C1050110B356CB55C86947B2D96384821374FDC83823DFAA8708B2C63536B5C5EDAEE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764599, "uuid": "460dac71-61f7-4f02-8f08-2772acd7e3b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764599, "uuid": "5025e9e2-b0cb-489f-a112-da17cb23169a", "value": "12288:hUY4glB+yzsZTEXKzyXVukdoRiFOCJrZ+/zdKSdlDo3Thcz87gFqvip:hUvglAhfzz0oRixJ1+pKel+YSqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617764599, "uuid": "128c5c2b-d260-4695-8433-6238e7bad46b", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617764599, "uuid": "3760d721-7ece-4e1b-98f8-de99c4f90506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764599, "uuid": "56201556-7e7c-4f19-8c4b-a9d712a28dd3", "value": "#100028153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96addde6-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617775243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775243, "uuid": "296c0ccf-49fe-46e9-99df-92db9cdd1451", "comment": "Malware payload (AZORult)", "value": "641e970f32447644bd26570d3be688a1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775243, "uuid": "9aeb5e6d-a189-434e-bdc1-d98a2def4da0", "comment": "Malware payload (AZORult)", "value": "2084b62c05ac13dfa48fde86f237473d35f3f169c030b829ceb49f3005b6451c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775243, "uuid": "146273e3-8c26-49d5-aa1f-9cadee7f4a1a", "comment": "Malware payload (AZORult)", "value": "fb4aac120c7d4543326e06f1438a570a62524b86", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775243, "uuid": "9c680790-6076-4399-8fad-3720aa4d4b81", "comment": "Malware payload (AZORult)", "value": "146352d0efa341c70851b749f1d4aac1c8823ccbd15a0d5dad3a89b9a9570dbfce476490a8dff27afd86b6129cb5d645", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775243, "uuid": "65a8540c-218d-4dba-8ddb-90f48723036a", "value": "D274E00AF96C740DC97C4BF818F6F3E5DEA17E6168D086C1278AB25EC63E2924E0C557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775243, "uuid": "1f112972-52d7-40af-8c4d-daeca0a2ef28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775243, "uuid": "582e2fbb-b786-4a13-b21c-dc686dbefae5", "value": "6144:eyajV1XzYabtiWSStfSrAOyFSKK1Kd7qR9QcDqd:enpdvbti5aZOOLjQDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775243, "uuid": "15422947-50b9-4206-8403-c1c7dbb41693", "value": 369144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775243, "uuid": "7c3d07a7-944d-48c3-bd1d-f1f815686d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775243, "uuid": "92f0ec0e-f4d0-45d3-a2f7-7bb2655fda51", "value": "IMG_767893434432.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f02049-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774626, "uuid": "6fde0105-2d48-410f-b505-faede5b014a5", "comment": "Malware payload (Formbook)", "value": "34a620b02619ed573e76a5659713ad0a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774626, "uuid": "14f8567e-2550-454c-8803-f64a87c424bd", "comment": "Malware payload (Formbook)", "value": "212fa99c63cef30d1c9738b16139ee494eccca1f8d85d499088aeff2dfd4b42d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774626, "uuid": "638e68f4-2bdf-472b-afdd-a60975395385", "comment": "Malware payload (Formbook)", "value": "20a834cddccc0ed683edcdd7d5e5b6b41cee8e5b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774626, "uuid": "f8eb0129-21fe-408d-a348-be750d4f5200", "comment": "Malware payload (Formbook)", "value": "c7b25d8b4d80aa18c10809d5fd68ae52dff2e9666e07db1eaeb77c48c4fcd3bafcfb2292431dd3c067e3e57cec3d4895", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774626, "uuid": "af2c8594-37dc-4df8-8157-5650da9ae280", "value": "2115CF2222856B55E1FEF734D870C7104BF2BA47E321DE4F7CAD609C59A7BC28262752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774626, "uuid": "ea2241ab-f9c0-4de2-b380-fb7f163350c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774626, "uuid": "69ace2ac-8e4a-4707-8ae5-b924043c078d", "value": "24576:GSbIUctqDnvZoK9mVNFjBO1R8TjnA6t6g5:G1AnvxKBO1R8Tjrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774626, "uuid": "a60e8151-f92b-4522-8c9d-e4e5d3772f6c", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774626, "uuid": "c235458a-f0e7-49c9-8973-d354e8fdbbba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774626, "uuid": "c22c1f46-a758-4042-bc18-806c90b87366", "value": "PO91361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd53bc3b-976f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617779200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779200, "uuid": "5522d967-f2fc-4e1b-a32c-2deb3fb74045", "comment": "Malware payload (AveMariaRAT)", "value": "de68080055c17be3bc943ff168145ca2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779200, "uuid": "f2723784-ff4f-405e-a00d-fae3a9cc28a8", "comment": "Malware payload (AveMariaRAT)", "value": "21d934d355f7dc6b612e4990391e3c3e958698cd7bc4192711fd22d0c1e35f6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779200, "uuid": "f5daa1f6-ee95-40ca-82a9-0106d02c5e23", "comment": "Malware payload (AveMariaRAT)", "value": "66b1a3f92abfd99ad40682ed0cd256ebafd6602e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779200, "uuid": "dd78bab1-4448-407b-a4b5-65778ec1e44a", "comment": "Malware payload (AveMariaRAT)", "value": "ddf22f4603f5a8daa6faa51eb557a86fe96baeae1937f1dda9b7d0ceccdfd1632612e50da069f16ce5767a0e1265f394", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779200, "uuid": "1cea8b30-d423-4a87-b5c1-77f0c0f05d1c", "value": "F352CF32BBA2DB29D51CFF7E9EAAA41B424D03E1C914C60A012DA39D54EB5C81B2D1CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779200, "uuid": "529ab6cc-4887-4067-a4b8-6474ed81fa6a", "value": "384:75HobEMwuXmvsTMHM7HTFNfExeZJuc2h+TWlbX+cdR0ILBTTNiS:75QwuXiRs7HpNfVP9pTWocZ2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617779200, "uuid": "eed6223d-a3fc-4a13-8b71-0bf35970004c", "value": 13931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617779200, "uuid": "738b1ef5-d2d1-492c-a0d0-f0a1c576b7b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779200, "uuid": "cfedf788-bc4c-467e-8ba1-64bef7a894d7", "value": "New Orders.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a48baf8-9799-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617797046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797046, "uuid": "45822553-cc99-4c1d-818c-2b97309d8712", "comment": "Malware payload (Formbook)", "value": "de0bfab8aabe9b50f4073c7896d9cfa0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797046, "uuid": "00006365-1952-42c6-9554-31cc47865111", "comment": "Malware payload (Formbook)", "value": "2257f689120126164dc655b13b83746d17a50d42510c5113460abb74b0393327", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797046, "uuid": "e0547ea5-d90b-43b3-ad7d-8df3f6c00ac4", "comment": "Malware payload (Formbook)", "value": "5abad54fa991e8ba0cf312a7460832bcb6ed329b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797046, "uuid": "29c0a11a-7a66-412e-a78c-2d8b91cfc5b9", "comment": "Malware payload (Formbook)", "value": "9d374d686c372416296b9286f5e3ddf311a48df61c1e89cd5be7925b127c67e14bc5601b896ca636d62c9f90455e3b06", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797046, "uuid": "da86ce0d-27fe-45f9-9c6d-5a4ed3e163f8", "value": "C2B42391B2111E9AE309F7733A43DDFED6186928E457D31A4B85CB1C837AC9C1D26A33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797046, "uuid": "8f431a62-e476-4d48-b6f0-55c5916ad134", "value": "12288:/CjURoH9mUaYayCqs0sgJ5TrPt3jJwqwbjz1GbMm6faDWiU:SURoH9OQCqDsgDXPLI0qfaDWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617797046, "uuid": "1104e1ed-2f88-40c5-b050-dcd489680ca9", "value": 504252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617797046, "uuid": "9bfaf799-affc-484c-88a3-7d845d4c9255", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797046, "uuid": "f2ff2099-f7fc-4e80-a9fa-c85c96727d23", "value": "shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182089fb-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794358, "uuid": "9269e99f-dfc0-443b-99a0-2381bfdfe892", "comment": "Malware payload (Formbook)", "value": "7bb5e280fa7ba8cf2dfce650034339e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794358, "uuid": "c2494f56-9059-4b3f-a4f3-1e7ac1e9a6e8", "comment": "Malware payload (Formbook)", "value": "228d3b8dea2bd47cf98d69b89b5acdfa3a1425e201217882edc93de72fe0e37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794358, "uuid": "01c7bbea-f279-49ca-95bf-486a1d8d4147", "comment": "Malware payload (Formbook)", "value": "86ce6053aea4432409d394b65ee3f6a8c6fb1a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794358, "uuid": "7b3dd41c-f187-404d-801b-a477ab5e4631", "comment": "Malware payload (Formbook)", "value": "2ece92ad2b613459a40aeb6c0cfc8673aaef247851516be07f530dd25494bd3a8b830f08b05579f2ba0a1fa68f9aae56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794358, "uuid": "dc8aa893-1ae6-47ce-aa64-27d7ed29b74e", "value": "32E424611C740248FEDE5EB6061956E71AD2ECA32A61902FD3447F26C27239CFDDA2F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794358, "uuid": "d5057803-9564-4e06-918b-9d19478da950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794358, "uuid": "553908e3-073f-4dfe-9b57-592f40ae89be", "value": "12288:aaRbDcM3Q3rOdeW++HhtUnNJ2WD+yOiyCyYP2Dm/KLs2P:DEZrOdv+Yh+NMyOvu26/isS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794358, "uuid": "982333ba-082a-46a8-9ea4-71789d6d306b", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794358, "uuid": "d16d8ca1-25ef-4e61-b2f2-2714b109733a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794358, "uuid": "dedda836-68f1-4c69-81fb-653ffbe7b542", "value": "Export Invoices_&Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3467e26-97b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617809731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809731, "uuid": "5a33f306-de30-4a04-ad34-8f6676a0c6a6", "comment": "Malware payload (njrat)", "value": "67b98281009cbfdb96bfaec29243f173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809731, "uuid": "8669d66b-a75c-435a-8e51-ca84e6ecf29c", "comment": "Malware payload (njrat)", "value": "234d9ec1757404f8fd9fbb1089b2e50c08c5119a2c0ab1311170ef1bf448a9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809731, "uuid": "5dcf9788-dbbc-4458-b607-a97a122a8180", "comment": "Malware payload (njrat)", "value": "2d162cba8e96a357006793c026cd34cbcb87e197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809731, "uuid": "41901a89-9d4e-4446-a78c-9119288846b9", "comment": "Malware payload (njrat)", "value": "869c20500ccd80d6992d86e915b217d081a92b1a9d87df5709335a645a8575dbfa84db516c246d9e74ab18b54347a3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809731, "uuid": "4dddd148-0ed1-4b0d-b944-44d8a14d05f1", "value": "C653E5722A74848DE50082F10BF7DAA4067BBE611BD6C5CE414E7EA334F914D9EA3F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809731, "uuid": "7894af5a-8cb2-43ec-a669-34e5aa208e8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809731, "uuid": "b03e677c-f80b-4eaf-9a0b-f7f2616e6d7d", "value": "768:CHHs5QOIsxyhkTcYT+5wXlQyt/57f9GOHCl586h403u/3c+1FhE+nH:CHHs5QOPfTHXlrJXHCU6e0+pF5nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617809731, "uuid": "ad03a06b-6fe2-4bec-9c0b-3a47f0cfe673", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617809731, "uuid": "9bf60e44-567a-4c00-9afb-13c03fe3ae70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809731, "uuid": "95796ac9-8895-4c09-a4c9-5f1e596ffc6d", "value": "234d9ec1757404f8fd9fbb1089b2e50c08c5119a2c0ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf473e6-97fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617839140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617839140, "uuid": "c3b797f8-d97c-4d71-99de-8acf10e49ef1", "comment": "Malware payload (AZORult)", "value": "d91babad9bc3c5af48f71b5d26e7dd81", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617839140, "uuid": "dba82b04-2add-4068-aa6a-5a05e058ccc2", "comment": "Malware payload (AZORult)", "value": "23668413a1cff07de7c539ce9dee7468ef08ca0b25454d7407112793ff9bc86f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617839140, "uuid": "7c50af0c-f725-40cb-8aab-e4a2ef782db9", "comment": "Malware payload (AZORult)", "value": "3a6e919d1d2de3085c261fdfb499d2bd411a8abf", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617839140, "uuid": "0fc8af45-9159-4162-9a96-16285c124387", "comment": "Malware payload (AZORult)", "value": "b16ad46f80face4e3472e99b26d50690a3af70b6524cb36f11057333922862d6d0807db421a43c79a228fd25b60a1fa8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617839140, "uuid": "dc626154-bc80-46ce-accf-2698573c363e", "value": "411340FCC914D9EBCDACF574A1F2944BA5B0F93720458A2B89BF56D3C18279628C016F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617839140, "uuid": "49706636-0ccd-4917-9aaa-6d69fa7a1181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617839140, "uuid": "38ce2d4a-4eeb-47e8-9265-a39956ae5db2", "value": "768:jbiYT1zbxO3Y9zydW+GflDGflvx/FIwJGun51aNmkHnhhk:jb5T1vxJ9OdsNmkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617839140, "uuid": "dfd1f69c-9990-4797-8df0-790cd9c8c5a0", "value": 44776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617839140, "uuid": "f458796f-4ef4-4e99-9999-4639d1fdc5f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617839140, "uuid": "85116858-4ee7-4f36-ad1a-2fc9054c3faf", "value": "20200804-8293847pdf.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d717360d-9791-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617793819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793819, "uuid": "80ef0f8d-2c94-4163-b1c7-efaba15cc68f", "comment": "Malware payload (NanoCore)", "value": "bc906f26edfec13cdb13d8a6b97f344b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793819, "uuid": "f3ffb9fc-43c0-4c96-b8d3-410b97a9a509", "comment": "Malware payload (NanoCore)", "value": "23ac7754b6ad5fc382857b05ad514a716cd3dcf861867d3be02a5a92ca7fe067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793819, "uuid": "8572c4ed-33c6-4204-aeb3-ee88e5f18181", "comment": "Malware payload (NanoCore)", "value": "33933248690d87f77693865e7393395ec2ea3792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793819, "uuid": "48464840-691d-403c-a9fd-91dfa0fff073", "comment": "Malware payload (NanoCore)", "value": "b3870afc804a4f89d47d921b677e3d4307fe749ac046e9d4ceb7bf9fd7fc46403f5016446485693c59cb7e4589c7828d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793819, "uuid": "2718328f-a686-4487-a6d0-38580934473b", "value": "F8D40241BBD684B2E53319364A29AB25797CBD202E34DE6FB3D81D2DC931181E624F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793819, "uuid": "87c87ee3-597c-4347-b551-b0420b818da5", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793819, "uuid": "cabe64d6-4932-45e1-8215-97b2abbf5b2e", "value": "12288:9crNS33L10QdrXP/X+tGfnYMOwYgc4T7fkj0D+8:ANA3R5drXPrfY+BS0i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793819, "uuid": "7aa2658d-acc0-4351-adb8-24a56a5688b7", "value": 620007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793819, "uuid": "9f522021-a9c9-4157-9513-3a01f24289d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793819, "uuid": "e4d91e5c-7666-45ea-bc89-651c4f00773d", "value": "BC906F26EDFEC13CDB13D8A6B97F344B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a932c309-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775274, "uuid": "b6aed18c-93fd-4937-9310-dc6e84fe385c", "comment": "Malware payload (SnakeKeylogger)", "value": "3e50a619af93a8d78fd957464fcc299e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775274, "uuid": "6cecb822-fce6-4774-8f25-8e2afc236f5f", "comment": "Malware payload (SnakeKeylogger)", "value": "23c566938824db35e8806a9f51f245cfd91e379016d76ba7a5cba8bca5e4b251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775274, "uuid": "33d72ad9-a6b7-4446-90c5-03440b1a52ee", "comment": "Malware payload (SnakeKeylogger)", "value": "21d998bca8b86599fa1c273aead7d5c11c8eb72d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775274, "uuid": "d9e9a739-25e7-4995-ab72-ad9276780e61", "comment": "Malware payload (SnakeKeylogger)", "value": "492c20c2aafc55418e1c25dce33996fe3d95dcdd94c5814d3ff788f0138d926ad3d7135c5da14d561aaddca30f798362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775274, "uuid": "657c1b8b-f7bf-43d3-b37e-d8784c7b4d99", "value": "1B05E02233946F65E5BEA7769060416083F2FD4BE736D68D3C9CB0DD2971AC1C262793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775274, "uuid": "6127fd8a-36eb-4d81-ba30-91bfde94d850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775274, "uuid": "abda35e6-93f7-4b6e-a922-118519d37aa9", "value": "24576:APbHRJ3DnxQ8lzdWDqSsvwSL1PW9i9mZhPRlrSMgFk/qV:YjznK8RoDqmSLpW9Om/Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775274, "uuid": "14df9735-a93e-406f-a9fc-215df44a212c", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775274, "uuid": "de7e931f-aca2-43db-9237-c3407c45ffcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775274, "uuid": "78f8ce7c-b3d9-4b73-8271-835b4bfd5ead", "value": "PURCHASE ORDER - XIFFA55.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a698f5-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775272, "uuid": "83325b92-1754-43bc-8453-d33d831621f4", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd8c809e5bf67bd47bfba2589059860", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775272, "uuid": "7c95410c-5311-4b4b-ab2d-23b7c7bc2ab7", "comment": "Malware payload (SnakeKeylogger)", "value": "24e10266a97f7e6ded7e0701f00fc7e70196de2cd7b6e201b1eec4acbc03ba14", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775272, "uuid": "08ea0e32-2356-44e8-b29f-5420dac0399b", "comment": "Malware payload (SnakeKeylogger)", "value": "1a3d57d7864259455db9d09795435743688c3307", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775272, "uuid": "761cd56c-9be9-4018-b7c9-a6a12dbe398b", "comment": "Malware payload (SnakeKeylogger)", "value": "9cb83b9e1f3535c3705a13fa5f94d42a77b42de969900ca932e305b4652d7c32d888562a95da5154d4fe24b5578de931", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775272, "uuid": "129a1d01-beac-4ef1-bb78-56411f500bfc", "value": "7A15D02232946F65E5BEA7769060416083F2FD47E736D68D3C9CB0DD2B72AC1C262793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775272, "uuid": "0dbd5cd5-0400-4ecb-9397-4a54da96cb99", "value": "24576:6PbHRJ3DnxQ8lzdWDqSsvwSL1PW9i9mZhPRlrSMgFk/qV:KjznK8RoDqmSLpW9Om/Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775272, "uuid": "89ae1860-3a45-43e1-ad68-2980cea7b493", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775272, "uuid": "26672b15-1c27-47eb-bb4f-e5de690818c4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775272, "uuid": "ab38e26b-ca44-49d8-9b3d-2b6f9afaa984", "value": "PURCHASE ORDER - XIFFA55.PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d81e22-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794403, "uuid": "2d825bae-6d0f-4863-a12c-9fa1cbda94d7", "comment": "Malware payload (AgentTesla)", "value": "342bd8c3a60ae69d9a43e6450ee9159e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794403, "uuid": "40179b10-1ecd-4c5c-91a9-955350fb398c", "comment": "Malware payload (AgentTesla)", "value": "25685edcbf3e0819974d5ef65c83950c4ebc373cb75243f5f16debe29d05edcb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794403, "uuid": "b6267131-4f30-41a9-82b1-42d935d71d53", "comment": "Malware payload (AgentTesla)", "value": "15241ebdd0611777291646775ffd323c064033fb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794403, "uuid": "bb9462d4-e967-4572-8b7a-64c416547b28", "comment": "Malware payload (AgentTesla)", "value": "357b98105bc0274fc18e12539898ab031ada9623c7738782fbcfbef546ae550174c7e02b0753ddf3d5cc12f52f21ae44", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794403, "uuid": "c552610a-4741-498f-a115-01a21d638fd8", "value": "40F4232B9C500FDB55E880631A0D4B5F1B7A93D6090477A81B13E23AC7A3218EDFBD79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794403, "uuid": "0cfc48ce-248b-45ac-ac81-49b94551e239", "value": "12288:WAP92t1Eq9ekeLeW8Gc/OUfLxZqut36c1o22UszLDz2y9mYJclCdHHBnbPmSSllU:WAaEAbW8G7sLDtKc1GUaz2yUEtjKMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794403, "uuid": "d093f0bd-59c2-4e82-a26f-a7201ff70a2e", "value": 727118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794403, "uuid": "05a20dcc-a8b1-4c2e-8357-670023026d81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794403, "uuid": "bd96d544-3361-4567-b161-7e046a7cbf27", "value": "PAYMENT SWIFT COPY MT103.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb7d08d-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617774929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774929, "uuid": "9708f1db-1d88-42c7-abea-00096c60e682", "comment": "Malware payload (RemcosRAT)", "value": "6e0beff439e2905df31ab9d6a0d076e3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774929, "uuid": "0c16a180-611e-4481-b364-59dc569633bc", "comment": "Malware payload (RemcosRAT)", "value": "2633901f3823c7c26a73a2041eb78cbe6f7a8c4afdcedea30cd840e515dc76f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774929, "uuid": "adf60082-59f0-4f4c-bf35-7a240598a882", "comment": "Malware payload (RemcosRAT)", "value": "7e66e5a50d845e2abd2e0ed993d7de1cb7b8862c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774929, "uuid": "55a6c1f2-e921-4ced-9736-c54790e17c79", "comment": "Malware payload (RemcosRAT)", "value": "aa88b612c969e9b991aedb44b7574875b13c8797ed3a86ece6b968fbe8c37479b0518832d770de11ef177dee31200cde", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774929, "uuid": "2c44ceeb-625c-4b16-a09e-d45ae52454b4", "value": "D7D423C93473810F9EA4303BD19A8A49BC37FBE90562C25FA97B0874181D6D3C659FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774929, "uuid": "5ee2ab37-d660-4fcf-85f1-d4a7c7b5a1cc", "value": "12288:HdOT16TEYvatXyNzxQroZRYdM3kET5JEeVYRu4mXLleGL62piv3h1Si5ybnDjD+c:HdI6oYvBKoIdFETfEuj44leP7vh1Sawr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774929, "uuid": "0d701c0b-27a7-4dbf-8ed3-8193054542db", "value": 606171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774929, "uuid": "17ef1079-9a9e-45b3-afa2-e4a03fb0eb90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774929, "uuid": "7d3e6438-4cdf-4371-b881-c21e1d8ba666", "value": "Payment Advice.jpg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa79eeb1-9792-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617794308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794308, "uuid": "681e168b-6ede-49b0-afc4-4b213eaa4584", "comment": "Malware payload (RaccoonStealer)", "value": "21e89e596c315bab4c83983433b445c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794308, "uuid": "4f0f43ee-888b-4fbb-97e3-aff48d562834", "comment": "Malware payload (RaccoonStealer)", "value": "27cb5cb27c8f29f4fcc7728b02a5a6f0f94f84ec1d17ab9284bfdb2e6b42ba98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794308, "uuid": "264f5cc7-ffdf-4b43-b12b-fbfa348016fa", "comment": "Malware payload (RaccoonStealer)", "value": "2bc794d690427bbac8ef5a29dc97b304c1608601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794308, "uuid": "ba183142-63a9-44a8-8ee0-62f1967a8afd", "comment": "Malware payload (RaccoonStealer)", "value": "ce2d11eebfa8cfada1f6fee85d16e2b13ca964d13f0fbd6a5b5e4783524a2d8f153d3c00b99a9adbb039451fd7ac060c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794308, "uuid": "04b8fd25-c29a-4f4f-9c36-2f32b6f8ce67", "value": "0BF51202B3D1D076FFAB92738B66F6165ABC78290123C92F13981D79B9701B1137E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794308, "uuid": "80b9466f-ef6f-4d8c-b6a0-974dccfc563f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794308, "uuid": "099fcfa6-ca2b-469e-b739-59c4b6c8a2c8", "value": "49152:Hh+ZkldoPK8Yaq20X8PjfX9syQ+7Is72aM5CX2TkKe3YBoUBNPoOPMuz3l0Pn4kq:w2cPK8h0MPjfNsyQwp2V+2Tc36JFz3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794308, "uuid": "f593c2a8-ea0c-4508-9b42-83fa61b4309b", "value": 3398144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794308, "uuid": "af9b4053-715c-487a-bb26-dba8c72261f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794308, "uuid": "a5877928-5c7a-4995-b53b-fd7c943d5ec1", "value": "21e89e596c315bab4c83983433b445c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e088d33a-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794694, "uuid": "bbeb66e7-f8ec-42b5-83f3-443fd5201a60", "comment": "Malware payload (SnakeKeylogger)", "value": "d507ea58a61693ce50e68240765f3057", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794694, "uuid": "95a8a77e-9a20-4e03-ad0e-1a358cabe13f", "comment": "Malware payload (SnakeKeylogger)", "value": "27e1e7ded2f85e28d24c402e3add4b2c9c49bac8b75a0f0900239054edb4886b", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794694, "uuid": "bd9c9c5e-ded8-459d-a4d0-ccb643b1719d", "comment": "Malware payload (SnakeKeylogger)", "value": "e20141fab084b12c234a9d870dce7daaf8caba34", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794694, "uuid": "be2bfa3a-3abe-4fc7-bc60-2b0a8d0a31ea", "comment": "Malware payload (SnakeKeylogger)", "value": "f5b8edccadd50e0c611b516926b4956617b17e64e9c4544281465ff41c8f83275cc5ef3e58f879f4faa381f2ada399c1", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794694, "uuid": "7f02388a-237c-4f61-b0ce-1a0f7af02d77", "value": "A615AD3822F4AB51D439423223E1D0245AF0AFACDEE6D30AFDB429C5B752DD82E9551F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794694, "uuid": "6b59afce-45cf-4bcc-8474-278f4b184fb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794694, "uuid": "c146b8c7-fbd1-4421-ba78-3bb865082d90", "value": "24576:WPtmaCJaLNYfhBGZ5IgOl+2LwhhFZRvDuW3Ad:WPtmQLKJBG3o+2LwBZ0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794694, "uuid": "a9f20c8e-48d1-42dd-964b-1de8f5dab48f", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794694, "uuid": "f6a4d569-7b28-42ea-b69d-c7fee2a4bee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794694, "uuid": "74c77827-672b-45ef-a8d6-192cdd16cf6a", "value": "Dringende RFQ_AP75887658_98788,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5795fbc-97cd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617819506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819506, "uuid": "6c428ccd-3af2-4ed3-87f6-b234419163a4", "comment": "Malware payload", "value": "d779f25a086dd77a1e5fa28cbb746024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819506, "uuid": "14e289d1-8ae2-4dbb-9f7c-a474bd1dd39f", "comment": "Malware payload", "value": "2813e0cbbb57f4da88440d39b0e375a728d546f5c3f12516cc0bf15f7ae35bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819506, "uuid": "e23ccc9f-e1f7-48c1-bf48-60c6657b58b3", "comment": "Malware payload", "value": "ab44bbb14bba99fd4c49b70e8885c0fb2b2eee67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819506, "uuid": "0ba19ad8-43a5-417d-a7a0-cc5cc0549953", "comment": "Malware payload", "value": "1649d76261aba6a30b369bb6b15e473f158ae99fbc6bee8af01e3e9832c27221ca4e859de2beec71ee006c1a3afe6ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819506, "uuid": "516f5ed1-2f6b-4ca5-9c22-be16f2a40686", "value": "AFA6D65C2590964FEF2ED333D38B394091E6B2E5993097628BF9E6C869FECC41285C1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819506, "uuid": "d1aff066-f105-4b0d-ad05-b72a46d6fb1c", "value": "b4b79086aeb287b2fcbff82d436a81a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819506, "uuid": "a36f4d02-2765-40ba-8ac1-2bf3a440d55c", "value": "98304:vMeDqBamHwHrDtBLSdOstjwa2geWz/R6yLgNDmkRNSoQBrkqWews7MFGO:/mQHr8ea2uV6eEBR3QB4qWen7TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617819506, "uuid": "44147d73-0be9-4337-9fc0-08d8beaf4bbf", "value": 9920523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617819506, "uuid": "75049709-0729-44c5-b9bd-70e9480a69c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819506, "uuid": "b8985b71-2d38-4a20-9b8d-05b572b7f81a", "value": "BullyMS_NEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a1d20c-97c1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617814409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814409, "uuid": "bab0ad56-b722-4d29-9b50-f3ec415a9927", "comment": "Malware payload (AgentTesla)", "value": "3578b2aca87b7f0d32a3395f5da371f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814409, "uuid": "742ba95e-5585-45df-80f9-d40f78c0fc71", "comment": "Malware payload (AgentTesla)", "value": "289573e9d2cb073c0a68c71a6e2aebc9215439d2060e81213d7fe7c69d5ed6aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814409, "uuid": "72b1dc53-9dbd-4b2e-b2bf-6514e290456e", "comment": "Malware payload (AgentTesla)", "value": "be042440ff093a613dcb8ea97e0a0e4cdc367667", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814409, "uuid": "25b5a9a7-927c-44a7-b60e-cc66b8a8f8a8", "comment": "Malware payload (AgentTesla)", "value": "8980b9710f5df2f64385c9e91340b0dbf2dc2b01a615a4c5f495b5c920eef8e6576848f5f9249f4f55e818ef5c99ff4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814409, "uuid": "85b2f830-d6c2-49c7-a0b7-975c1999e500", "value": "06E4236FDE0F0AB48D2F673E9F9F692404D1281219F6488E106B28F96DA59DF0DB51F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814409, "uuid": "99fa684c-47dc-4b5e-b78d-53a9b6d85433", "value": "12288:YtQccyzudUhTblrTGB7fRfwTaIizj9BZhim4oruT7BoaSp70HmVd4Ebqd72vE:YtQIzudUhlriRRAaIGL6/upMQd4EbG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617814409, "uuid": "801a9501-2b3e-46f8-bee5-cafdd37cb2aa", "value": 681822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617814409, "uuid": "cdd761f3-f1b9-49d2-a9be-9576d6241338", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814409, "uuid": "716d2a2b-16b7-4ba9-8a58-6f0213a78650", "value": "PROJECT SPECIFICATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9894e86c-97b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617807458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807458, "uuid": "246ce76b-45a8-4d2a-b329-6a0eaa25da08", "comment": "Malware payload (AgentTesla)", "value": "6f73be782606779f3ecc58b948fd7193", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807458, "uuid": "9df9baa7-db76-4176-8f1a-74d0aa02a8ad", "comment": "Malware payload (AgentTesla)", "value": "2932ec551638f368420eb09d8a740e5412cd185d275def420fab2f877584676e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807458, "uuid": "256d95ea-0078-4541-993c-24360f058499", "comment": "Malware payload (AgentTesla)", "value": "f619d551a51d59e8ed7848f6f9e06ee321a669f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807458, "uuid": "05cad389-c47a-4855-b599-791c4f1edba6", "comment": "Malware payload (AgentTesla)", "value": "005fdae4b75faa37e9bf479d956c8c0100aae44dabba9b321080626cf74447a81b58519d3f96415d7d381c3d5d04a108", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807458, "uuid": "9e1274ff-0623-4f4d-8520-e39ab0902bce", "value": "8335E0223251AF96E3BD57348061927447F5BE9BEB21C70E3DACB1CC6A35BC5C662312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807458, "uuid": "51f6ce8d-7c1b-435b-9bcf-847aa35a1347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807458, "uuid": "253e9c3b-fdfa-48f7-a0d6-2a865acf3061", "value": "24576:ZXbr5kQMDn30dwohSPINIeMVX2lOBGvLe:j3mnCAI6VX2FvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617807458, "uuid": "63189111-4fdb-41d3-bc6b-0dfecc6b2a2a", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617807458, "uuid": "f20f8bf2-2523-4f09-9de8-65a06727650f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807458, "uuid": "c60767b2-8964-487f-9d95-6ebfd8428214", "value": "SecuriteInfo.com.Trojan.PackedNET.624.13772.9426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c5ab50-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617794572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794572, "uuid": "d649557d-6e73-4ca9-8143-39693605f307", "comment": "Malware payload (BitRAT)", "value": "0a7626252200f305e4140c6d76e860f5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794572, "uuid": "23c83ec9-f9e1-40b3-934c-dc160d02a383", "comment": "Malware payload (BitRAT)", "value": "2b0e93f1d73a56b83d023faf8f08811bf58ecf2eb45a845339498901a6121720", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794572, "uuid": "ebefef59-b12b-4db7-8326-bfb33b33ef03", "comment": "Malware payload (BitRAT)", "value": "05e68a503e6e8b34c77fa0780c6fd06c310a1317", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794572, "uuid": "7e496b9c-22fe-4a69-8277-e305b278ff79", "comment": "Malware payload (BitRAT)", "value": "dc5a6913e8df56a25613b74ebd16a8434edbc8596b904c58e5c8eedb4e20766cd618df452633b72ba3639ac87936f894", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794572, "uuid": "d78f4035-4218-4160-888d-e31ed32e3929", "value": "A6B533718CF4195A212833FB29BCE8EBD35C1BB536A48CE8CEDA6CCED91851749D14D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794572, "uuid": "683dc125-55d0-4b9b-8c00-26ec7dea3e22", "value": "49152:xeWzYF5v1RZ+oxeeC/mnP50B+1O2QhAepgcrrfXL2TL:xeeYF5v1WhnmhLvepgYfXL2TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794572, "uuid": "c7c8a90b-a795-48f2-bae4-aece82e19a20", "value": 2308033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794572, "uuid": "110fb422-010f-4715-bfaa-53f30ba1876a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794572, "uuid": "e3d4792f-4caa-47bb-95a4-71af26488f2e", "value": "ORDER343346PO3455.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3ccca7-97d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822609, "uuid": "18eed36b-0d85-44fd-9596-9f8beeeec792", "comment": "Malware payload (Dridex)", "value": "11d4fa567bf1ced0b8b6b7bb16273443", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822609, "uuid": "693404d1-f59a-4739-b816-097ae898f8d8", "comment": "Malware payload (Dridex)", "value": "2b4a82f0e8d12c9c0454ecdb906ffddd851f808481f712b234c61f8986aa42a4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822609, "uuid": "40b689bc-cf44-4fc7-8ea5-a510baa7c2dc", "comment": "Malware payload (Dridex)", "value": "292f15cae8c9f943dd1328970b994cd565a16c43", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822609, "uuid": "52e47b4d-f88c-4d8b-8c3f-d4bb888d665e", "comment": "Malware payload (Dridex)", "value": "ccdb5f8c8cfde01ae6c15a09816acf6ad4afa2e641e17739e8d39a2e92b927ad166b5707be026cf29c71acb0e3e4634b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822609, "uuid": "eaeefce4-1e08-4108-90b7-54eece47ce08", "value": "B014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822609, "uuid": "9e21e90b-90b6-4bff-9039-81a5d27afbab", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822609, "uuid": "031ccf22-1cec-42f9-a6eb-f462cd3e98bb", "value": "3072:dBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:dBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822609, "uuid": "33470c09-4451-4cca-b190-d76af2391d90", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822609, "uuid": "70fcbb8a-04f6-4060-8125-dcc83fe1ab22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822609, "uuid": "34237f98-6046-417d-be50-c106268b855e", "value": "2b4a82f0e8d12c9c0454ecdb906ffddd851f808481f712b234c61f8986aa42a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840d4dcd-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617768340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768340, "uuid": "3cdfed4c-7bfc-4ca8-bc1d-ca76d01bb44c", "comment": "Malware payload (AgentTesla)", "value": "4e7783a560f5b2b7a25b539454e25478", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768340, "uuid": "069120b2-7534-4055-acc9-3e32d8ecf6dd", "comment": "Malware payload (AgentTesla)", "value": "2bb77f6842577ebb19eafc91bdbb4c8ca47f8821171621ec674584f86c59fb0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768340, "uuid": "e83e039f-03ae-4bfd-bcac-6c811fc5dbae", "comment": "Malware payload (AgentTesla)", "value": "8c02fa149dbebcf130ab8a47239af9649425a97e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768340, "uuid": "ee077822-f1ce-457a-a5ba-3f9191a7f368", "comment": "Malware payload (AgentTesla)", "value": "60e7b8cb194623c56df5436361b06376539a17a02d06f6d42eddaa07e593c01767c419d06f133a544ce5698723ee4e93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768340, "uuid": "c8f77127-ac62-4bdc-995f-f26acefed13e", "value": "27D4238CD653660EFC7834C08CA29D3311E7A376B35BE7F898949255C93A13B764CCA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768340, "uuid": "67b8857b-51e2-40e8-8c64-f42fb141d5c0", "value": "12288:tU/ikyTMTNbCYrNvteW76ODgcoDz8uYsIBVYNS8k3WfVLQlW3kNBIXiX8io:tUa0RHsW+ODgFDzsvh3WfVeW3kNBGiDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768340, "uuid": "1781526c-d7ce-4845-90bb-768c34b6bd01", "value": 629715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768340, "uuid": "06fb87ad-a064-4727-810a-1c792023628f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768340, "uuid": "c7fa7391-a154-4030-bc07-376fab686032", "value": "PO #367459.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e83412-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774792, "uuid": "6a954a06-98d2-40c3-9c18-958760ecc194", "comment": "Malware payload (Formbook)", "value": "5c3c47d30b92f01c319250946ae86961", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774792, "uuid": "d1d9d2e8-b796-4be8-b881-5fa215f7e0a8", "comment": "Malware payload (Formbook)", "value": "2c23f2c834f6d9fe89f0cde03a516eea04b945b464eae3f042e0a47fb2390a05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774792, "uuid": "db84f45d-666b-4438-9b8c-27e89727d551", "comment": "Malware payload (Formbook)", "value": "4a1755ef9e537430d2a907b061794f448f50d1c0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774792, "uuid": "d4885a08-a70a-403c-8294-1f25cc8260f4", "comment": "Malware payload (Formbook)", "value": "1090e8893c4e205ecefcc4b9c6a55e6bd45271f37a9900fc019e026aae117731b16904668c685655940fec03cb03a286", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774792, "uuid": "86d318fb-9366-4248-8c59-abad3d9c3e86", "value": "5952D1D31EB280B341AA2DBC1AF4907D4637D6956C9CA49FD37C138B6B71E21E760B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774792, "uuid": "d83f6672-6d32-4665-9600-6356d2e7a1bd", "value": "384:wdDHhu3BxDShvA3aoiUAnvnCkmcQQZqVHLol:+hixav33UASeZqVHLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774792, "uuid": "a12528a5-0d9c-4ef7-931b-cc7139e81988", "value": 13758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774792, "uuid": "ea029621-0db3-47f8-a826-561c8560f919", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774792, "uuid": "b6da4f45-4730-41ad-acec-059b814e836a", "value": "BL84995005038483.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8647210e-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774786, "uuid": "11af9200-5798-4dd2-96df-cea0184931dd", "comment": "Malware payload (Formbook)", "value": "44a7fe299bb64d278bb22d6256c651e0", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774786, "uuid": "b9867e53-ab99-4b82-bb44-fe51cc14a20f", "comment": "Malware payload (Formbook)", "value": "2ccd14ce326ef6916b4d7daeb220bd498ca46f52c0f4ddd1855f21cd984221cc", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774786, "uuid": "64c7de6c-e32b-4c40-9770-225648a729de", "comment": "Malware payload (Formbook)", "value": "fc914ee7e22494c6de2ff846cc69cb4f4aa842f8", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774786, "uuid": "7d8ea59d-321d-4979-8942-8831e09d5a54", "comment": "Malware payload (Formbook)", "value": "aec561f64ed310829be4d0ed0530fcf2cf3e1076207ad6d29125127e9c1b93377ed640ae9a657dd845202de37e2a9097", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774786, "uuid": "7c20f5d8-b42d-42de-b31d-41596bdfec8e", "value": "AC6423DAD19E5621B0D5BE79EEC122835C02685656D8E0E8F530FFDE49333DC53A2B24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774786, "uuid": "05fa7665-9962-44cb-bbd5-40eddc528aea", "value": "6144:QAMj/2yGv/UlnrMuR1CA8TrhE0gsEGtaQmZnN1zgFRl8Ywl4+WSJD4Y:Ij/2LneYhE0DqxnN1kZBbSeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774786, "uuid": "6b26802d-8412-425b-92bc-47948366140a", "value": 313973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774786, "uuid": "83c50364-1d66-4927-99d7-4c8f27696f9a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774786, "uuid": "0e97f5e5-43ae-42ea-aad6-393d1b61a107", "value": "PG6432 KHE SHELL-RFQ-Project.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1196aa-9754-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617767357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767357, "uuid": "082b14e9-3b9a-44dc-9aaa-5d3d7daa2e4b", "comment": "Malware payload (SilentBuilder)", "value": "73690262256f3a4872aaadb37acac4ed", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767357, "uuid": "48cf2244-23ac-4fe5-95da-7a48fad273aa", "comment": "Malware payload (SilentBuilder)", "value": "2cf291ca376a58d5ed057798b78331d28e1b16efcf193181ed0f85ecb05dac76", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767357, "uuid": "889e6b50-6fd8-4a71-98f6-23174046cbfd", "comment": "Malware payload (SilentBuilder)", "value": "cd4327807142a8815c3a13a46ddb7abd8f23b32f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767357, "uuid": "1151b362-a925-4505-86a1-1d291460f036", "comment": "Malware payload (SilentBuilder)", "value": "fb02c23fb7fa003503d845161c9dc81190074f51a69c74439effbabd0b63587c1a5bbedabc3f8b03be12fc56ad70b257", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767357, "uuid": "62bfafde-f6f2-4cb6-9f10-90e89f49ac18", "value": "8544E6D2B2029128E0541F3AE572067C82E6FFAA7B18F49B6C05B3B77B771D13E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767357, "uuid": "93a6ed51-cd0f-457e-977b-6b9be031e9d4", "value": "6144:JcPiTQAVW/89BQnmlcGvgZ7rDjo8UOMIJK+xTh0e:Fhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617767357, "uuid": "2e0ed9cc-bfc9-499f-bcaa-f45caeb6c290", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617767357, "uuid": "b818e589-e002-4c2f-a78f-dfe2da0a3f0c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767357, "uuid": "ae435726-dfaf-49bb-abfb-fb755773bce5", "value": "SecuriteInfo.com.Trojan.Agent.FFFK.23764.7918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d58682c-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811225, "uuid": "29faa4d8-24f5-4428-ae9f-4d59480ee544", "comment": "Malware payload (Sodinokibi)", "value": "56b9c44b62a03b837df7ad35e8ef3dd4", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811225, "uuid": "ae4a24e5-1e7d-415b-b5cb-cd270ec09322", "comment": "Malware payload (Sodinokibi)", "value": "2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811225, "uuid": "7fcdc78c-b3c0-47ac-a592-a24e6b5ae874", "comment": "Malware payload (Sodinokibi)", "value": "75a8ee1cba41ff1e0bc042d54657b3b76b7275ea", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811225, "uuid": "baace2ab-095c-423f-a4b1-faf6ff6169d4", "comment": "Malware payload (Sodinokibi)", "value": "28fb13a1280f9b47645d212301ad3fe5b28ff0128efb1bf5610c4ae490fdb73aa41583e7c0d827dd417515586e8213da", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811225, "uuid": "ef5d3b3f-b0ab-4e55-bebf-92743c08c1d2", "value": "BEC3D023ADA142F7C99341F7436F3E2B96BEFD321921587BD33049445969282EF1B623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811225, "uuid": "05fc4919-a47f-473d-9ae3-5114fd0e4671", "value": "031931d2f2d921a9d906454d42f21be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811225, "uuid": "0d65940f-9999-4d72-9eda-f4b09561731d", "value": "1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9DepYMoLMAZZTx9FBCzL4:+/LPrlAZZE4pY/ZZTvLC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811225, "uuid": "850df189-62b5-40d6-be65-751b3538a4a7", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811225, "uuid": "26a7cd1a-6dd3-4072-b897-fcf81bdd6869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811225, "uuid": "42eaa318-d5f6-4c62-b5a5-9ffa2ab1debe", "value": "2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b60423-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824362, "uuid": "a806c0d2-59b8-4d6a-9202-b664e0944cee", "comment": "Malware payload (Dridex)", "value": "8f2358b66e95d0feb7a7d69950430900", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824362, "uuid": "b7daa983-b999-4297-b957-d50d3539ab2c", "comment": "Malware payload (Dridex)", "value": "2e40a25f265dd356a4aa6d5aa4262a89555c021497772c9e278541bd8a2cb707", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824362, "uuid": "0efb81ee-6f73-4638-9538-a9a5ef568f48", "comment": "Malware payload (Dridex)", "value": "5c4cd9a4d66916631cdc20d2696db61bf7d5deae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824362, "uuid": "cfb95d0b-f583-4674-9798-d37b8fb04d99", "comment": "Malware payload (Dridex)", "value": "de51275987e4edb90c975ef0dc85aa23c8b59498ac34c4769c617fcd36bfdb62511ce60ee7c87c0571057a3d81d9a941", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824362, "uuid": "1d30778f-0650-414a-92a7-4bb3a8e6761b", "value": "30249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824362, "uuid": "ffacc216-7afa-4108-9fb2-7ca147f8fd3c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824362, "uuid": "c81aae01-1378-4258-8657-93577948330f", "value": "3072:w0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:LpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824362, "uuid": "41cc0e0c-ec15-4d46-95a4-e6d889b58383", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824362, "uuid": "3fdf40f8-a2e4-4230-b52f-1c7fb4403077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824362, "uuid": "d797bf7a-bb37-4a91-b8c2-9d8124241545", "value": "2e40a25f265dd356a4aa6d5aa4262a89555c021497772c9e278541bd8a2cb707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672934d7-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774734, "uuid": "87536013-c1fc-4f7d-9290-c795f65ea9b9", "comment": "Malware payload (Formbook)", "value": "fdb984b7b8ee5c77865fad6921e610bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774734, "uuid": "993aed1e-2b7b-49db-84d9-69bcc285380c", "comment": "Malware payload (Formbook)", "value": "2ecba20721fa9432e4e407b62f815f12b6fee820b5b348547175c36a274c7f16", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774734, "uuid": "c348a2c8-9126-4109-9690-88cb6b61c87e", "comment": "Malware payload (Formbook)", "value": "4b2a2605e9db96e5a179a9b173c3f0f879570192", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774734, "uuid": "b250b75f-f902-41e0-bbd9-b3f6a6241e8b", "comment": "Malware payload (Formbook)", "value": "ede02b8fe1bb763b9a0e4707b3d32d364b7771d2d5aeca07e49d33c62e0a2a7c8cb1eac9e70a3e5255ae25a13aba8c94", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774734, "uuid": "944f980c-0360-4411-bfa2-e60041a9cecd", "value": "B2C412164F4B0E0BC95E097A43FFCA38E7B0FA1870636B12DDB5B22986B76C534412E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774734, "uuid": "aa249bd7-d6f3-45c0-85a6-c28267f5254f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774734, "uuid": "ce0c44e7-d2af-421e-9647-19ce654a0e19", "value": "12288:QJeRim58iliwOgDkeM2wxDyOiyCyYP2Dm/KLJ/fWAx:d5l0dgDH5wxDyOvu26/iJX3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774734, "uuid": "e38d704a-f9f2-452c-b1ac-268ff104da77", "value": 592552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774734, "uuid": "2cd66415-0fa9-4377-9311-1516052b0eaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774734, "uuid": "11e47952-a7d2-4da7-b326-43fc3a57a8c2", "value": "Purchase Order_NO189.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b50b804-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824106, "uuid": "b1873f94-d984-44db-b2f9-b00d8b9f72e2", "comment": "Malware payload (Dridex)", "value": "a389ee51ccea0ea9e087ffcdff18eae6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824106, "uuid": "e240b310-e1e4-4e04-a44e-a1e8c95c2873", "comment": "Malware payload (Dridex)", "value": "305dd29a31e93aa15f0957262ac215d0e9f7b1db52d08633b036c65df670bc6e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824106, "uuid": "7bf684a1-8fdf-4ee1-b759-d0258a2999e3", "comment": "Malware payload (Dridex)", "value": "f4a6e7ac0715950bfa44cf6c0516b49da86943e4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824106, "uuid": "7711f249-1750-4cb4-8d63-8f51659d8cf6", "comment": "Malware payload (Dridex)", "value": "2221bbaee6783c1818fee515f85105466d178235c2e9d207c25adbfd3e2d26463eafd20b86d4402aea60a489aec11658", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824106, "uuid": "dbc8c60b-54dc-42b2-bb1c-8605b69c1a19", "value": "88249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824106, "uuid": "a437c181-1836-453e-a3df-32652f0c3fec", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824106, "uuid": "fe93817c-e9b1-49f0-9544-4a5e765e25d5", "value": "3072:q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ppepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824106, "uuid": "9513f8dc-e07e-46e3-af94-89539e1a1645", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824106, "uuid": "a0559c5e-36a3-446f-8d3c-28c484521e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824106, "uuid": "06fb2c24-0e01-47a0-9ba9-0bde05327882", "value": "305dd29a31e93aa15f0957262ac215d0e9f7b1db52d08633b036c65df670bc6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24540326-97c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617814994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814994, "uuid": "b14e63e7-8f22-463c-98c1-16035abcaff8", "comment": "Malware payload", "value": "787f9ae55c239f251349b97b0b07e9a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814994, "uuid": "0891818f-ed4f-4c89-8d7e-4082c0423ee7", "comment": "Malware payload", "value": "31389f1f0a969916b26e06f6bc6013594e749db84d6603b466b194ee74ff4172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814994, "uuid": "a455e423-572d-48d9-9b19-52fcc1e3b73a", "comment": "Malware payload", "value": "829198420a5ea96ee532d79ccc7aa9eafb9ad34c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814994, "uuid": "b09d8199-e88a-4a39-91c6-9e5dc46ba9b3", "comment": "Malware payload", "value": "7de26beb24e924ff75b1ce33382cb4f522bd1d5a2bd9bb454331340d30a7634424ee160fa33cbbe816d11fbe8231a544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814994, "uuid": "244c8491-4f9f-454b-8753-60ff904b26ea", "value": "C055CF70DB0C7A25D555FE3AF42196A0ED562E5B73866F047C84BAAB3CF7210C7ACA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814994, "uuid": "a663d555-a0f3-46ac-92cf-6aab0030aa24", "value": "12288:TV4NV4zIvyHXhQOEaIdSjqekTQ4H444h:TV4NoMYtJJGm4H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617814994, "uuid": "d57e3ffa-ef41-476b-884d-632e028a375e", "value": 1290752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617814994, "uuid": "5e4f570f-007c-4ed9-9cd4-5ad761759978", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814994, "uuid": "b683fff1-a3ae-45e2-8061-a7777551716b", "value": "Shipment reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460f313c-97ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617805173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805173, "uuid": "29aa0f91-41a1-436e-be95-fd8da104b27d", "comment": "Malware payload (AgentTesla)", "value": "dccbb91149aa69ef73d5052acd9e61e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805173, "uuid": "da19381f-c55a-458b-a5fd-1cf5eef4de6b", "comment": "Malware payload (AgentTesla)", "value": "322446b5ae1f53dbe666a593b36ba33fa2ee8b20a277b1bce1ac7b735b3df5cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805173, "uuid": "e3b7fdbf-f2fe-42e8-b3b6-e75d00661040", "comment": "Malware payload (AgentTesla)", "value": "3253133c562ec98c990a0d063a1cc4a5b1dddeed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805173, "uuid": "eb66595d-24ee-4b4e-9322-adfa7cfab5dc", "comment": "Malware payload (AgentTesla)", "value": "175b249b082780fc66f245b4c804cf0e4519e1cdff9470b1086a23cddbfd703ed9658133c0a3046631a3de34fd4f1d8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805173, "uuid": "76ad7a14-5965-45fe-8e18-f4a9e18fc4be", "value": "C205E03152004F9BC6B812BEC495D17052F68E863265E7CE3CF41DDBB9D2F86732269A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805173, "uuid": "baec08e2-1b34-4603-bdda-324ab5974f0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805173, "uuid": "a54fd1de-5614-43ca-9cce-6118aac66519", "value": "24576:VDXf1dGxPP1Lw19J/P2Ne5KFqIxNi8Ejmme:lXU1EDJnj5KFni8EjmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805173, "uuid": "30bc4e6c-904d-45d8-8085-5a322301a56e", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805173, "uuid": "f3ee1c53-bbfe-4056-aba1-34b3816ee467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805173, "uuid": "d71fe7fd-a8cd-43fa-8230-1dd940e32839", "value": "FarmParts Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9c7f20-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617811331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "088dd4ee-2ded-48e2-8bbe-7abc3019d781", "comment": "Malware payload", "value": "9a8cb63ba1a6cd61aebd4ace808ca798", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "cefbf1b2-3c38-45b1-baa9-3db773224375", "comment": "Malware payload", "value": "32820cdb75ca6167d011b324e7463403119d2fe0cacf86fa534c87be661c98ce", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "c38dc52a-553d-4201-b925-bd6d45bb2dc9", "comment": "Malware payload", "value": "480c6b3b93e378bf505e04669706ae65f90286a5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "24916d33-0727-4d9a-b080-ba65d38e6f07", "comment": "Malware payload", "value": "72de19c3db6ca6e90c4a49c9b9b0e9082250c4d9d52cbaf257b3770d4cf143eae9a55eb2c18f0d18483fbc8c7b811c94", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "3d115a6e-25fe-4e3a-904e-7c85b8011e6f", "value": "22924F87B6450292CC95FA1997EA5A8EC3B409B3547D60C5FEB065CF3F90A2FC9C11B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "15e588c5-6f56-4731-adf0-018e8567bad4", "value": "384:VMMLVL9Bd6kaaAd+mk8Vg3a6GOykIGXYURANBcVEYzUdj/e88NkavZwiZCROIfC9:VMMLVL9BdNaaAd+mk8Vg3a6GOykIGXvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811331, "uuid": "3a520033-3824-458a-b541-1a7f205c10f8", "value": 20579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811331, "uuid": "95f237ce-e253-4869-aea1-b9583b559557", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "07938c2a-e2df-499b-af9c-705a7b743d49", "value": "NF-electronica-8453004902..Docx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713d21d3-97b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617809969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809969, "uuid": "12157846-e9d3-4c4d-a9de-cd042207ef60", "comment": "Malware payload (AgentTesla)", "value": "da904c29c09022cefaba934bca826e74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809969, "uuid": "9de8e88a-39c5-4d3d-ad46-737ae7331cfe", "comment": "Malware payload (AgentTesla)", "value": "3342286be6613a7d6f98b02d3e646898aa2e7bc9b87e2bff2966796b6dc7a9b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809969, "uuid": "09e64871-5332-4b3b-8e80-6f7eda83e5d5", "comment": "Malware payload (AgentTesla)", "value": "0808dde97899651b4384ba2d393c697269cf74f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809969, "uuid": "e5caab3f-2635-40a0-82f6-3816a096770c", "comment": "Malware payload (AgentTesla)", "value": "08d087b7da94e6a0b697fb0ef55eb20f9586d62d69aa3b79c12f8c1f8b7926a77080009c4433c5cc0d30b92a7932dc7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809969, "uuid": "21c1aff9-1eba-4319-8e4c-982263740585", "value": "D3157DD8DDA185E4CBCEC6DA4D193F9920632A7DCAC37C5A483472F90F9363F5A16860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809969, "uuid": "58bcc5a9-ab78-4629-b2e0-ea1c81fdb853", "value": "24576:dNdCItn5Yt+IZwdNH8SiVcd9JnLwIAwAjEnCB2kGdis:8QQZExABiUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617809969, "uuid": "ec86b0e9-d7cb-401e-942a-390a8e10c9bb", "value": 879198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617809969, "uuid": "1897cace-3dbf-4dee-8c22-e4d9ab6c14bd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809969, "uuid": "d6b6d1e9-00e4-461c-b6ba-4ad2ed314a6c", "value": "items list.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66473116-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774732, "uuid": "c04a3288-b27e-431a-a14c-ff792f4afc5f", "comment": "Malware payload (Formbook)", "value": "5cf36bfbebffe287ffce646459ee90f0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774732, "uuid": "36037e0c-dd2d-4e29-9dd0-e2d64940ae8f", "comment": "Malware payload (Formbook)", "value": "34fc11a2129f1c6edeb812563e636682646bfb50e120f6570acb5c21b0bc6439", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774732, "uuid": "8ce39cef-c228-40ca-98ab-270a7fbedf5e", "comment": "Malware payload (Formbook)", "value": "e46a656a2a4476a381f4b0cb25088b95ed7a9066", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774732, "uuid": "44408ecd-06b8-4a5d-94a8-b2ce07f40510", "comment": "Malware payload (Formbook)", "value": "75ba269dea9ce7460a1292b63e28b1a7565da926e59db44d8d8b791cdc924b27188cf4bfeb79bfc6cdf01cb2b1003a1a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774732, "uuid": "225e0a49-9dc3-47f7-9aae-4b6d3f8d0ee3", "value": "1EB4236C6A43131C5238A6CDA1F86A51FF358624AD3ED73E4168494D82CF5C890AB7FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774732, "uuid": "c5b982c8-f8e9-400d-b712-5126db4f33f3", "value": "12288:VRtCm58faDOgJkeOxlQOiCryLYYJ2KLky+K0TZAOW:ntx5GgJHOxlQO/rXiktlAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774732, "uuid": "e0592971-93bd-474c-beaa-8eb8f8951d3e", "value": 514465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774732, "uuid": "acf50983-4351-4ce2-be04-bff7c9339e83", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774732, "uuid": "4d68f8ed-5011-40f2-bb24-03768beddaf3", "value": "Purchase Order_NO189.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947a170b-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774810, "uuid": "b56b894f-14aa-48d8-825f-b986c739d6da", "comment": "Malware payload (Formbook)", "value": "6c14c52d7e2b4678db367f29fbc19685", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774810, "uuid": "886b973f-ea0b-4577-87d3-83e066e55349", "comment": "Malware payload (Formbook)", "value": "358a0a67eec7dc0c2997111de61d1cecf61e9f02b2450b93d7a2dbceb3f044c4", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774810, "uuid": "6f433350-0f7e-402b-ba78-443242f2a812", "comment": "Malware payload (Formbook)", "value": "a9a12070243ccac09cbae2ce66fefd73e47acb04", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774810, "uuid": "42030629-d38a-434a-99ce-d10cc4691490", "comment": "Malware payload (Formbook)", "value": "51cff884e34f575ec35c8acea2ad743d919c3820fdde2eae3e561bd52bb318c00411fa0b8b4ac329f0588c90af603153", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774810, "uuid": "5c4ea822-330c-4c4c-b71c-1f9b4a0bce62", "value": "1D1412C397E5986A70BD532C04BA086A273C3054F9AE89379CE296DF5D342736191F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774810, "uuid": "1b4650ac-f0e9-4305-805e-39c2d0700cbb", "value": "3072:OfGyfZzst58Rsm25VcgbPD27uOsZw0W4rnmCFFiULMDl5JqUVE+t:OfGS46s3bK7ulrnzF0MmN2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774810, "uuid": "03283300-489f-45ca-89a7-19b05b3f7692", "value": 194159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774810, "uuid": "e869e6b7-32c9-4c15-9954-a5379210f485", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774810, "uuid": "4c4b5a3d-9b58-458a-94e1-a701c98b09b7", "value": "payment.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91364770-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774804, "uuid": "ad4b36fa-0f88-4c7d-bebd-ca457d7ec780", "comment": "Malware payload", "value": "90c5155bc3ec966fa11833e21251a9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774804, "uuid": "7af0daeb-372d-4ea7-a287-256391232e70", "comment": "Malware payload", "value": "364afe555167f1dddc5231ff116a558a65383cd947bbf67fc7fbdd85172ea871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774804, "uuid": "da9c9ad6-78b0-428d-a998-7a4a163a1fb5", "comment": "Malware payload", "value": "1d25e2c57051f3eec7fa07b2520712e788f2b264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774804, "uuid": "ae6650e2-439f-4b8e-8120-b5b5fcb3ff32", "comment": "Malware payload", "value": "336fab55742dfd2a929a03a126544e80182a658d52a652cdbc09200e7c5fa1194955c7b3d94e8e1d3afc8ca36bea0a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774804, "uuid": "e273e3b6-859c-4fe2-96fa-fc4aac0950b4", "value": "7B73C1D48891A330C534BEF9A7373F2B8E98C258B5A1C8561E9DF793350812466ECDE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774804, "uuid": "7201db39-574a-4a05-ab10-bcf8f37fb382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774804, "uuid": "5d89a6d3-6127-4545-9f7a-47a204290c02", "value": "1536:qGOKZBZWPdE7zQxEbS695bK4DSq4D44Di4D24Dt4Di4D34DY4D54Dz4Djx4Dtc4W:qG1/ZWj4DSq4D44Di4D24Dt4Di4D34D3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774804, "uuid": "58914d64-3b5f-410e-8882-b1c14dde03d9", "value": 76464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774804, "uuid": "d48f75b1-a93e-4cf9-aaa1-dd93bfcf6c45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774804, "uuid": "4ea654a7-21fa-439f-8ba3-7ca93ebca7fc", "value": "Download Report.06.05.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb41fcf-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617774931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774931, "uuid": "80d58fbf-2574-4d6a-84f3-c3e730529e02", "comment": "Malware payload (RemcosRAT)", "value": "ecaf8b888df1cfea01d3566ec4d4a41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774931, "uuid": "f3943a05-1625-40d5-a6b3-e02b9ed1d578", "comment": "Malware payload (RemcosRAT)", "value": "375b5d8e986b228149dbe2f4cd9df92e697491052531a094fb7172ad0d25bd82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774931, "uuid": "98d375f3-5428-4e45-901c-b8e581b567d0", "comment": "Malware payload (RemcosRAT)", "value": "5e3d0a75b6d7e701397eab5d199dc4e8d881356f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774931, "uuid": "4b78f0de-c91e-431c-aceb-3a8c9081706b", "comment": "Malware payload (RemcosRAT)", "value": "79fa3334749252a14db4ea0ad0abf39056f43ddd486e13f8f57b84437f435b10f0461a6c3c42bcc3d6476670927d799e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774931, "uuid": "7d0f5065-df9f-4567-8298-bc75b81e3b17", "value": "EC35E12728C25564C5994F31E2785CE822B32F1BBD15D76F684933E8EF3365F22216A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774931, "uuid": "6bb1c0ef-933e-48e8-8bba-22d11a3d47b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774931, "uuid": "503edad2-47f2-4e2f-ac90-5d05fe3a68b8", "value": "12288:gpIV1Fn6OAVo1Tj5H5xwTpJOGNasB3tIIuHdDzCq7R7Z:Z65o15H5xwGmaI4AsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774931, "uuid": "131f4a9e-bd1a-4b61-907d-0c0c853bf280", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774931, "uuid": "60aeadb7-d914-44b5-991a-411064f8928d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774931, "uuid": "b6982074-9ef0-429d-a572-27b3f1b988b5", "value": "Payment Advice.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723a7a59-9790-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617793221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793221, "uuid": "c3277c26-2687-4f8c-ad29-7ecf9f265af5", "comment": "Malware payload (BitRAT)", "value": "bb2fba6e9842f0f6add31b25fdc5bb10", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793221, "uuid": "ef3b29a9-794c-4455-b8c5-4327685bc404", "comment": "Malware payload (BitRAT)", "value": "3868205ed7d9b0d3007ce0e1062c27e97c1e03d9bf655ff902bb85afd47a74b1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793221, "uuid": "b4264cfc-e768-4419-88c4-d8490e48494c", "comment": "Malware payload (BitRAT)", "value": "e612764aa3d56cff3ce82769857557abd2056bb2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793221, "uuid": "3e3252d4-314c-4263-92fc-8c510dd040e6", "comment": "Malware payload (BitRAT)", "value": "131869d751a72d60f138340103fdbe76d8cfd449d43a1845e4596a93d48a4e46887e371e4e29915fb4270900ee82bbf9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793221, "uuid": "278ec3dd-53d0-4503-96c4-35d429a5855e", "value": "5D26122123E85F1CF03BEB3955B4740587FBFA16E312E94DBD9542CB5622E80CB9076A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793221, "uuid": "a9718051-28a0-4a2a-8caa-695c92a733ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793221, "uuid": "01e0d54f-3f69-4407-964b-4a6516ccf31a", "value": "98304:HbSY+GZms4xn3S0UmTepTZoUfIn4NEqa2szcfCZ40DXfb0mMszw+XY/MVzEUzEX:haG44aNPdrfb0pNGYE5ElX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793221, "uuid": "1993f360-fb6d-441f-9a96-6e63052a4ddb", "value": 4551680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793221, "uuid": "c3ae70f0-d58e-4bd7-bdae-08bd50a3e732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793221, "uuid": "3fe6a3d1-6f35-47a9-8afd-d57ba7d24700", "value": "BB2FBA6E9842F0F6ADD31B25FDC5BB10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7693af11-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824152, "uuid": "b5b00c2e-ce50-497f-aa95-b9d710079b91", "comment": "Malware payload (Dridex)", "value": "5cdad8b2016069d2649713f5fe92238c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824152, "uuid": "e04da0fd-48f8-4d86-852d-d24a148c9b4d", "comment": "Malware payload (Dridex)", "value": "3b80f8217649ed8cf8de89b731c6c0e171bbc0acf061d16fdda11b6f2dc6b2a9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824152, "uuid": "e70c2be4-352a-4851-971a-a7d71ffdca4b", "comment": "Malware payload (Dridex)", "value": "1c8696c3eaa3205cc2ad6ec064699ed7d8938273", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824152, "uuid": "b0604223-92a1-4f03-a905-5ba2b99230d6", "comment": "Malware payload (Dridex)", "value": "8318a54ec01fb0eb906a3ab9d58a4303266f7f6223cc35a199267f8a82d3f0af40f2322dd938f4ff4766502db6cbd99c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824152, "uuid": "237c2d6d-9878-421d-8da7-f4baf7092904", "value": "84249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824152, "uuid": "1a9c6c3d-2a67-4416-9169-d375ddb3383a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824152, "uuid": "0e8457d6-36a2-4114-af59-ac339e9c33e3", "value": "3072:50DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:MpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824152, "uuid": "3dc12b3f-112e-4f30-9683-7b36f085f857", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824152, "uuid": "c7955e3e-0f33-43b6-af79-c313eafa4d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824152, "uuid": "34104660-8517-47e6-b328-4e1b3d87ea07", "value": "3b80f8217649ed8cf8de89b731c6c0e171bbc0acf061d16fdda11b6f2dc6b2a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633833f8-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811234, "uuid": "5944820b-c2a5-4ce1-a7e4-9d6efdca1aa4", "comment": "Malware payload (Sodinokibi)", "value": "91e06d83a0ea2e73f8143f9d70c2b8b1", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811234, "uuid": "31e00aec-9699-40ea-ba6a-e516643e047b", "comment": "Malware payload (Sodinokibi)", "value": "3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811234, "uuid": "5d30af3d-0cf6-4ced-acfc-2b858ebb9091", "comment": "Malware payload (Sodinokibi)", "value": "7ff7ce00ddb41170fe4b86858ae7bf4b9957ff0c", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811234, "uuid": "c69ca630-81e3-45ed-8d9e-c117f28fd0fa", "comment": "Malware payload (Sodinokibi)", "value": "a6147cd91ed8bd3d49f75231eda0f5de9c89d00fc0b691929eda7174bf329eea68249eace8526000016320fa47f0ed52", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811234, "uuid": "4ee0a9cf-22e5-4ef5-85c1-8d3f69924397", "value": "0CC3BF2379E142B2E59380FE133B3F2799BFFD358611585AD3204D4A4F6A581FA2A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811234, "uuid": "cbc047b3-d3a7-416c-a47c-fd03638b2695", "value": "12b3d5a940cbcd57463181405f48f963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811234, "uuid": "34b8b803-00cb-4686-bef5-1c1ad16116ff", "value": "1536:uRnNZyC8Pw7RZCq3L6xVh1uK0igtprD4pTqMPfLICS4A0q8ZTHdf7+GUrX3dZgM+:/zY7MjtIprD0Rfwiq+3UrX3DZNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811234, "uuid": "0ac33388-0398-45b9-841f-dab955f5ad05", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811234, "uuid": "8e647700-37e4-47ec-883f-d3be8f486327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811234, "uuid": "f15ed6ad-a7d1-4da4-a273-c97c976bce70", "value": "3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bc1269-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775235, "uuid": "7f71c907-ac9e-45ea-94d2-b3bcfae593f6", "comment": "Malware payload (AgentTesla)", "value": "ae3a5cbde8ba646260fd10b579d6f901", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775235, "uuid": "44f17e3e-27be-49aa-bfed-057a048298b3", "comment": "Malware payload (AgentTesla)", "value": "3c5c160f6499958befccfd086fa9636d047bef057c95195d606b51a86832a7d6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775235, "uuid": "6f1ee0e1-4bbd-45d0-b1db-82647b7018b9", "comment": "Malware payload (AgentTesla)", "value": "d18419c185715f3c5a10d14c0700f9ecbc469cf7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775235, "uuid": "a3353760-3ada-4c18-823c-95fedfac12e7", "comment": "Malware payload (AgentTesla)", "value": "c3bb1f85aac9ea89dad1dd81fe61b4bdf2faa59db6aeef253b6a37b49327e0a5cf1bf7799948373c1e6d03e4033b3c0c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775235, "uuid": "e1445c18-27b5-4343-8424-725100732049", "value": "68A533949CCB1506D5E46CE5932490D09E6FDE220C9B0AD73229DE18249CA495FEDFCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775235, "uuid": "24522208-49db-4b2a-8dc3-d3808ef339d2", "value": "49152:4VoO+bPF885V+tAcXL2bxiqXLH15wrUUc43RfU2oyf+Mpy07CzhaEtsdZ4/N8D9t:bbPCQV0AIKA8LH1wFdR82BWMcThaEGd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775235, "uuid": "40e3b738-66f1-4dfe-a8bc-d93e03d28d70", "value": 2229511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775235, "uuid": "f7efdfaf-87e2-4b9b-b607-1fe9f70fc6fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775235, "uuid": "e6cdfb69-373d-4b26-931d-c39888ca7229", "value": "POList Order == Xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934987a5-9776-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617782109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782109, "uuid": "96656ee7-c73b-4e85-9997-e90e2e8b8474", "comment": "Malware payload (RemcosRAT)", "value": "b560c1126b2e27ec044832743f163000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782109, "uuid": "f51c30a3-9f6f-4f01-8904-d03598f24c70", "comment": "Malware payload (RemcosRAT)", "value": "3cc981a7b504f9c20ee0a8497581f43b007eb3c412d85b87ef7f0cd0c5a145b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782109, "uuid": "e72bc32c-0efc-464f-9307-8520ac0da7ea", "comment": "Malware payload (RemcosRAT)", "value": "74ad1277557d02a35729144fbdd6a7aaf1bd5de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782109, "uuid": "5988b002-df32-4e09-9125-a6a1ec957a32", "comment": "Malware payload (RemcosRAT)", "value": "723a5a5b12eda470f64f14174dad1dc74cc2bad32bc72ada333bec68012df09b7e97fe3d0580d52025e5973170e0c659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782109, "uuid": "e220fc92-e829-4b90-8d85-8b8e4aff9ac0", "value": "00D49E32A6E14437E1B32B7C9D6FB7644C26BE0139E5B44E2BE41C0D5F38B817929396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782109, "uuid": "86016e8e-e699-4a97-a9c2-d54860469960", "value": "af52f63bf30089caa8a0bd17b5f786c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782109, "uuid": "bdc1be69-7d0c-4152-a18e-22b667b43e5f", "value": "12288:/3e7vWhDoA/ytg+9qfAsVfbv3APwU/OyVF:/O7HA/jfzb4IUDVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617782109, "uuid": "34cd6d11-00a8-40ce-897b-5c61e0ec5610", "value": 652104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617782109, "uuid": "53a4c243-6ab5-4238-a5ba-ce678e915b41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782109, "uuid": "8924c764-c3b9-4c02-ab34-72010b4eca9c", "value": "New Order request Ref E100-#3175704534,pdf.e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb66d0f6-9774-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617781344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781344, "uuid": "15a5fec1-610c-4955-b3c0-d7e8ce792fa5", "comment": "Malware payload (SnakeKeylogger)", "value": "d8a8a9e029ae744d12fc28d6d9a18f2d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781344, "uuid": "20ed0c6d-a873-4b1d-9dcb-14c2b5ff41f4", "comment": "Malware payload (SnakeKeylogger)", "value": "3f1f2f8374d41a597c022b0943511ea8fed6c67b4b58f0e4a6601dcb22bdb98c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781344, "uuid": "310593c8-63d8-4394-bc30-4375bcf22258", "comment": "Malware payload (SnakeKeylogger)", "value": "60b8ff8ed0d458ffbc3b7cd17c0b149dc5c1850b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617781344, "uuid": "21f43d28-2655-431d-9492-8b6bc4ab9635", "comment": "Malware payload (SnakeKeylogger)", "value": "fe42ec7766c4cd9471d1114b9e74b05c7fcff03d1b0f283078779fea3f7d2b162b25d25151064d70188143712ef7f944", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617781344, "uuid": "a28082a1-a8f4-462d-89df-3ba95c2b97be", "value": "7875E0F81E141E06E27E61B1AB3D73C9A653F06967D40CCC34AFD235937FAC96A61062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617781344, "uuid": "85e1a678-0de3-44ba-b10e-4006f436347f", "value": "24576:msososososososososososososososososososososososososMZt7:5////////////////////////6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617781344, "uuid": "3d71b2fb-d2d6-4459-b9be-a6832ac0db9c", "value": 1662547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617781344, "uuid": "08a942dd-5d6b-4c35-8fa5-a142ce740897", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617781344, "uuid": "66c184bf-daeb-4615-9457-a0975b8bc98e", "value": "Payment Slip E05060_47.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1efc60-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811248, "uuid": "5b334824-9849-43b2-ae86-1d9169097eb7", "comment": "Malware payload (Sodinokibi)", "value": "0c7c5fcfb2368c716ce7eb0eda3f3533", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811248, "uuid": "7eb871f1-f948-4d93-8e1c-55380763b07e", "comment": "Malware payload (Sodinokibi)", "value": "42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811248, "uuid": "51771e59-3b3a-4391-8a83-988f3f5d232f", "comment": "Malware payload (Sodinokibi)", "value": "96854d0cb673bd8575acc0c864052ce6b03ec9d2", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811248, "uuid": "c1adb251-ec2e-4132-9098-cd2e79a84803", "comment": "Malware payload (Sodinokibi)", "value": "1d3bc3b57259fe97247d7f2ba23a13aa1bc3f0f9b28b48c57674e0f5506f71d2e1fe1ee206b1fae53b90780cb14b2104", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811248, "uuid": "06d4030b-142f-45f5-879f-f2db100329b9", "value": "D3C3CF23ED5142B2DA9381F3033F3F2799FEFE3618155866D32049881AB51D1E72A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811248, "uuid": "e9c8908c-ef53-47c1-8747-1501aa031878", "value": "b321b6896e18906d7c1d33f3e88fe16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811248, "uuid": "0cd757d4-6fe2-4e5a-b5a1-4d43a4f6d0f4", "value": "1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUmoxIdlVNYLoPh:mmV1wKdLoLC/OemUx8V0oZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811248, "uuid": "ecf5dc03-0b5f-42f3-bfb0-6c8dd1e83f1c", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811248, "uuid": "31f495fb-00f4-4466-9b74-e356bee335e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811248, "uuid": "61bb9d48-7f3b-4ee2-9833-c30e62e78838", "value": "42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2412807-9767-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617775692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775692, "uuid": "d44735d8-4a33-4d04-b793-c1739d2e7dc0", "comment": "Malware payload (RedLineStealer)", "value": "294a582eb61705a1391bd5b340c479b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775692, "uuid": "bb42d14d-7149-4043-9fad-b9fb3b8ca41c", "comment": "Malware payload (RedLineStealer)", "value": "426a5a8b7c71fdb7baebe6b0e866db5b69d23612f1156fc72d76208c2b8be691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775692, "uuid": "c1d502ce-9731-425d-92e2-938e3dc8cb48", "comment": "Malware payload (RedLineStealer)", "value": "a42d8869a8bd1671dc567ac3637157ebc2cabf11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775692, "uuid": "e5891422-9d35-4517-8758-7007a14fcccd", "comment": "Malware payload (RedLineStealer)", "value": "5b41cfa12074f51531918872995d931182829722ecb55dc3d8167e877d31602caaee83c463eb8b31753013e172b328b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775692, "uuid": "72e079d5-4859-40d4-840e-535c5a527e1e", "value": "01C5242162E8CFE1C0AF2575DC96B2F44613EE10CD658FCB7E847E1A39B1295A93118F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775692, "uuid": "afa189c5-eafe-4be0-bac1-162b983c6010", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775692, "uuid": "91b25524-613f-4a46-a8f0-51cac15a581c", "value": "49152:tkQTA0fORHyQkqoxYkc6kRY5h/gqSGNonM5:ta6EHoHWkcpUQgoM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775692, "uuid": "d6737c38-bf2a-43f4-823a-30fd94366cbb", "value": 2497539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775692, "uuid": "a7e8bbd1-0a61-4a6c-9fb5-f2c5d5f35d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775692, "uuid": "05e19595-2ef1-4b45-bf43-fbddc6d760f6", "value": "294a582eb61705a1391bd5b340c479b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0de9f4b-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774938, "uuid": "8d050f62-45b5-4574-a810-7c9db262a3bd", "comment": "Malware payload (AgentTesla)", "value": "fe34d7a23bfcb7360ea9d9f35cf7a41d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774938, "uuid": "7df27a18-1736-4266-b89e-79ec0f579717", "comment": "Malware payload (AgentTesla)", "value": "435f33d244e5ba7440626cc8809fc7633fb6b3989b24c663d9313a65aecaed66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774938, "uuid": "cfc3121b-ddf2-4cca-bfc6-747e94c8e80a", "comment": "Malware payload (AgentTesla)", "value": "ce3cb6513500037f849999af18b617b97ab58932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774938, "uuid": "75cf7065-fecb-4a41-927d-aaca40202503", "comment": "Malware payload (AgentTesla)", "value": "33f79639639a58b4ee01c4e16cdb6a0562adf6c8e7a9243492bd4479b6326c9ca3cb1d42cadd17035ccf62c0788edd2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774938, "uuid": "7caa924a-2491-48a1-af4d-813f423f6a8e", "value": "3F150210B346CB51C85912B2986740434779FCCC7C13EB9A4A98F2D63836B9C9DDAEDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774938, "uuid": "24f1ae8c-9ec9-464d-87a5-63b758b825a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774938, "uuid": "4fd10c58-9114-407b-8821-1cc59246434f", "value": "12288:YClaHdyzsFPweovKYaCctXYc8fMyS0tj3gbLZs/lcTSu473jMVVqgZ0+:YCla9hJw9vK7bXYc8fMKxlcZ473", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774938, "uuid": "eb552427-4daf-4c1c-a604-8b08602d3401", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774938, "uuid": "c7071e18-7a7e-4edf-bbc7-2d69124e82bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774938, "uuid": "e92d81d2-a14b-4f68-a6fe-29aa12211b35", "value": "PO#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3284133-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794699, "uuid": "9e187cf4-686d-4cb6-8fa7-32b5805dc05a", "comment": "Malware payload (SnakeKeylogger)", "value": "4138495cd942b253246d9bd965760aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794699, "uuid": "82785d47-1bf5-4a6a-99e3-cb4f550e9b69", "comment": "Malware payload (SnakeKeylogger)", "value": "446a9c4fe226595e6a506d2a27c4b433b5651f9f8110ab289371f080a596a779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794699, "uuid": "77a5e495-d17d-44b2-a68c-62c3617f1b11", "comment": "Malware payload (SnakeKeylogger)", "value": "fb80d388264dd3bd07b9a815958970f495e01021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794699, "uuid": "e70a4fa0-ce0c-409e-a052-cc0ae47379c2", "comment": "Malware payload (SnakeKeylogger)", "value": "af94b86a6e4a0574e37b5afffa7ce84ab95dfb71e52d5879c9924f5e0f630810fe556335c02ce416d6862a2da6dae4c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794699, "uuid": "ad91ffdd-3c69-4195-ab13-5944d10f7462", "value": "C4055CD1F190C8DAED6B45F2AD2BA53024977E9C54A4410C56AEBB1B76F3342309FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794699, "uuid": "8193b549-d761-4fb5-a127-c4f284d743da", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794699, "uuid": "c4ecbc1e-1b5a-4530-a1e0-9f8c191af4fe", "value": "12288:R4KOS7vY/q1dQ1NB8LRRX5uGowgUlBnnvXq7qtar:R40uNB8LvGWnn/q7qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794699, "uuid": "80ce8424-1da6-4c36-81f6-28d9f38041c7", "value": 871603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794699, "uuid": "5f582b35-c237-4bb5-bcc7-928562373591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794699, "uuid": "41a5bfc0-6a03-4b3c-9738-ba894df3b8a3", "value": "MUYR09080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4485abb-97f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617834993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834993, "uuid": "32e1ad0b-7703-4a1a-9b80-a7f12f1907ad", "comment": "Malware payload (AgentTesla)", "value": "9af9f7f1bf962b09503ea67859639dc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834993, "uuid": "7c3e88e6-e51c-4157-8eb9-6a08f96f3789", "comment": "Malware payload (AgentTesla)", "value": "44b8dc61b2015982e59b619a6a0e4497f6e23cf7cd1ca9f458443beaaec51b1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834993, "uuid": "a31a2686-2ab0-4893-a0de-defc5a9b1b17", "comment": "Malware payload (AgentTesla)", "value": "53b1c6f4cb0ede4e9c9b4564cb13cfac10c9dc56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834993, "uuid": "63c526b4-4804-4801-b46b-b6b7baba647e", "comment": "Malware payload (AgentTesla)", "value": "d7cb6951cc58ad32cf11f92e7ce360f72cdfec5671abb326c9a7cc6584655b7551c2a068f02bdb6d48fbd0d060f93579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834993, "uuid": "38fd1f7c-d897-4436-b354-c360198c50b0", "value": "84B423186A5F77608F9D88F1C6F39D5D6342A6AC0CB6F0B8AD10A934EB3CF34895D449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834993, "uuid": "54140661-83fc-4e0c-987b-20c960b0c214", "value": "12288:jG5t7sCT9rY9iJ7rhnkzxkDJjBXFi/TjqYaoQPNL6V8:aEChznOGFwjp862", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617834993, "uuid": "54b94639-e1d1-464e-85a3-cefa99b5384d", "value": 514922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617834993, "uuid": "0ab14d46-662c-4aac-9086-8a680f2167fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834993, "uuid": "bd7468c1-197e-4b86-be74-ff7d6cd3f218", "value": "UPDATED SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab299b3-97b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617807972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807972, "uuid": "98e443b6-3190-49d5-bd57-827ffa0b6d38", "comment": "Malware payload (IcedID)", "value": "a9f7a2d48ea27bd19790f77cd8d367d5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807972, "uuid": "e1a9aa6a-e8c4-462c-a462-f53db7122f9b", "comment": "Malware payload (IcedID)", "value": "4610342804689436dba57ca154601d66ff4953022123ba06da7d438517eab128", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807972, "uuid": "6303d6ce-04a3-43ec-91ee-62be00d9ad5c", "comment": "Malware payload (IcedID)", "value": "fe2616491b8f64e1af67ec49f566f084d41a3687", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807972, "uuid": "fb9de837-c0d2-47bc-8cee-c8980959d9de", "comment": "Malware payload (IcedID)", "value": "648c0ee55606c074ee581b6ae82839e3878ca8f8c065fd93f939c8af6a853cb801de418ac1b068fd39dac39f3a8a0eef", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807972, "uuid": "4c2707fd-0fe7-44a7-aeaf-e81f1f3bd6b2", "value": "7A43BE42DEF684F0C66FDE7C85DD531BBB41F232859985B7F4914B52CCAEB14098A328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807972, "uuid": "1e58b9da-9a73-4d4a-82df-5cba90285e18", "value": "2cb94cb9fe38dfc9abffc209027d5a1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807972, "uuid": "08fad3fe-559a-4d0e-a81e-129cc6a1d23d", "value": "768:Mf6gUHnXyQZnvPxfffPY4Hb4Ve5DEeVA5SwgR8LcCbG0FHm0uQfDgBpDGhh5qyuQ:G6n1nvJfPY8bMe5nrwgIcmG2G0R4KTZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617807972, "uuid": "e49104d6-36d4-453d-ba11-df229c486bd4", "value": 60435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617807972, "uuid": "94d56ebe-bc00-4447-b261-4a70f7d9d99f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807972, "uuid": "cfb278e9-04c5-4556-a162-89f5a2d3d3a1", "value": "aunobp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7e4c26-97cd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617819281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819281, "uuid": "d72ff1d6-6968-4f50-a7a9-e60e9ce57742", "comment": "Malware payload", "value": "c1ca77af76d289e637bb390a3e1f234f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819281, "uuid": "4125ee8b-bf48-43a9-9b9d-829a98252348", "comment": "Malware payload", "value": "483ce500c97e69b9937400f16c2cbf2cdd56017020051456efc24137f03f2579", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819281, "uuid": "0842c637-d3ea-4cfe-9d43-9b4dafaa9421", "comment": "Malware payload", "value": "4a54ce8ccada2b538407fd251766b0cc1d6886be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617819281, "uuid": "21bedcb0-ec5d-473f-8b7e-67221a2aec3f", "comment": "Malware payload", "value": "0bbb2209e3471f7037efc0b1a0861af309ec8423684afea503f2f70c6694bebeabfd5d6c7cd4db56f5ac6b15ac2f4796", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819281, "uuid": "b75b0b44-f128-4442-abd6-9dd128be3e7b", "value": "27F53340EB70E790E65A467D99ACAE13F974392380756FB72EE3178016DC1D8A0BED13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819281, "uuid": "393b6fdc-36ea-4ac8-8bf4-3acb0d5ecdb4", "value": "98304:7Mj3ZIfij8ZV+RFIWufj8LZJoEg6pMeSHC/qurdKo:4Nq8RFIWuwgSIi/qurdKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617819281, "uuid": "619be9ed-ff3b-4b7a-82f0-9b5aac8dfd7b", "value": 3600674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617819281, "uuid": "d2624bb5-dbec-496f-a52f-7604083795ef", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617819281, "uuid": "b6dccabd-cd9f-4830-9feb-a1337f9a168c", "value": "Invoice doc.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102d732d-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617794345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794345, "uuid": "256efbf3-d855-4c46-9ca4-95d7fc356d22", "comment": "Malware payload", "value": "c85df9908b9f5b20d9d87305902beb10", "object_relation": "md5", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794345, "uuid": "2f95267b-dfc9-4b3b-949b-65ae8f6a4f6c", "comment": "Malware payload", "value": "48d25c5b9b73012e8b2df3579c75ffdaa1f9d1686d6155bea7c1d5a5065f229f", "object_relation": "sha256", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794345, "uuid": "3e7932fd-57a6-47ad-a5a6-2d0b4022f01b", "comment": "Malware payload", "value": "ede5237060374a7197635bb82656a038f2d3503e", "object_relation": "sha1", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794345, "uuid": "a224cb2f-d5c3-4fd1-834f-829e41680066", "comment": "Malware payload", "value": "2a4be9ea1ec67c522d1c12fb26b3f84b142b7c8ce831c4f62fd6892d6a8c675eefafee8a9f02a40e3973fa22f199bddc", "object_relation": "sha3-384", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794345, "uuid": "1a5e0586-81eb-48df-9941-8354d1702cc4", "value": "4A05E1265E2DE851C60CC4F3E65388CBA870AE6463C029937967BA3F817C357EE1E15D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794345, "uuid": "40b4cd38-92b0-449f-b668-e4d861b449fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794345, "uuid": "d917a4d5-c308-45a5-aa2b-4a287d955f2b", "value": "12288:/uBOr/BKj76k5BLpcWyOiyCyYP2Dm/KL54WeImE8C2Gu+6WG:GBC/BKj76k5ppcWyOvu26/i5n1zu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794345, "uuid": "93d24bf6-8108-42aa-bc55-9636528eff37", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794345, "uuid": "18b4cfd5-2d65-47d6-aa08-6e94ecbdd1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794345, "uuid": "9ebce3a5-58d1-462f-ad87-7df7c4e34335", "value": "PO50164.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cd577b-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774700, "uuid": "70d80836-0b53-4234-a65e-e951f08ae1f2", "comment": "Malware payload", "value": "5eca2262d6a1d316873de2ca01b02bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774700, "uuid": "99b2632f-f399-4ce2-9e5d-5d0c30d3472f", "comment": "Malware payload", "value": "4a91d67fc60a86db3fca975f88a5323819d92d5421be279751f29c8cf6a3f4d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774700, "uuid": "efb66055-cb2c-46eb-a24d-66f689cd9995", "comment": "Malware payload", "value": "91d9cad4b43cd7a2c1f1bf4567e3841c242b0c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774700, "uuid": "d3e89a9a-3340-4ab9-8c2a-8e1010b07d11", "comment": "Malware payload", "value": "e733a9a04d1479d8d1dcb30a08e19d3539410961a7ccdd79ab3c881efa8462a7f97cba246234d9ed7759ef0eea4a824d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774700, "uuid": "66d9b973-45d6-4c7c-8092-e79d714a46fc", "value": "D0356AC09E4A78CDD4AA36F0341180FC83AB6D2226CDA3D697B3F9D65733562CD5069E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774700, "uuid": "075d8942-f4a2-4a40-b3c9-a4a8c60c7b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774700, "uuid": "13ff5986-9de8-4b34-b9ef-894cf583f66a", "value": "12288:Jju6x64SuvmwhwfENHF5/zHTTEgFNTPtYkfrnOuW/gIeK09eIkbP3t84NugS7ICW:JLxgu+awfyn7NF9hpIeKBIS9FZCfLcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774700, "uuid": "7d700d6b-305c-46d6-9b99-4f14d8f9f4a2", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774700, "uuid": "c232e5f0-b524-4e9d-a5f1-77ef1cabe085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774700, "uuid": "59a89128-df98-4ed5-aa89-db72560632f7", "value": "Specification 01012_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8823769e-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617774789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774789, "uuid": "18112bc5-d987-49e2-a4f9-18066c46971a", "comment": "Malware payload (AZORult)", "value": "b3c6206c87d1bd8676efb1765c8c0989", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774789, "uuid": "c814706e-d282-4d8c-b33d-e71efc1c0358", "comment": "Malware payload (AZORult)", "value": "4c3bbfc3b926616efe05cab622cd9a8f270a2223a5dc8911900577947cc5d087", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774789, "uuid": "94c436d5-1d20-40e6-8a28-b1acfa57b400", "comment": "Malware payload (AZORult)", "value": "ebb305da85e9d167f9386086536efff872ecb92a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774789, "uuid": "8dac4f11-5370-4f11-be69-3ad7f68c9b3d", "comment": "Malware payload (AZORult)", "value": "5bc42bd0799c4ef1bedef3e0b01c89e43d852f23b13c3685f988713b5ece1e3483783f0c7a5fdc614521744711560c6d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774789, "uuid": "d4ce7bec-59a1-4a15-af57-e47587af33aa", "value": "73D423C1F6F431E56A40B49B5FD55227A3A8EE6E51F9044F18EDC8C2A792333EA3416C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774789, "uuid": "bcd0eec2-4d30-4d69-9f34-06b2893594f2", "value": "12288:PYo2irxDBG68Ec0Qc6sBFeiqi0og8BXzddI4lU1MCZ+ktlgf:PYo1r1BG68Ec0N6qFeip0J8BBGHZ+K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774789, "uuid": "44ad26f4-e5b8-4ffb-8bd9-6d863d5ba237", "value": 615920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774789, "uuid": "2548501e-63bb-434b-9123-c30444c8ec99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774789, "uuid": "7929f6e7-ff1c-4efa-82e5-6b9bb8d57d77", "value": "RFQ4734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adfcdb0-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794416, "uuid": "d7af9bbd-b38f-4774-ab0e-b242bcaa0d30", "comment": "Malware payload (Formbook)", "value": "fe2ba65bebc0323d5b7600ddfa008fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794416, "uuid": "da2adbcb-968e-4243-9101-e48a8e9696ff", "comment": "Malware payload (Formbook)", "value": "4c687f5a0d352eb6e530e2939ec33098787e626ccd60026ff692ae8c368a5eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794416, "uuid": "0941e4cf-b076-4c87-bc1f-05813ad3080b", "comment": "Malware payload (Formbook)", "value": "8d6241e41a9be6c17d62efd510225996e01f4b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794416, "uuid": "7fd0f8bb-7eb9-4403-b9ea-bf5f832c7673", "comment": "Malware payload (Formbook)", "value": "793da346aa6ec8f8c5f874a0e46da6dfdef177df91a2086a2a8991807c14b66eb5f8568e7d4703b9f09b3ac3fe7984d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794416, "uuid": "9472850a-7430-44d6-8334-b34c5a6c24c0", "value": "4F639901694B9466C3CE54F95AF0F2F4485021A1C54A9EED4EBC7B4760F3233AB9EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794416, "uuid": "ab297757-50fe-4a43-a4b0-40be571824e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794416, "uuid": "37d495ff-f260-4b56-a825-62d65048930f", "value": "768:CRgp9K0AsiseBumyyAAypZG41eA8AgEnWVP8uMDEyUhd:CRwK5lubyDypZG41h3gEnWVUuMDEy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794416, "uuid": "4bc05cc3-a39a-4240-946e-ec4b6e1e4fb6", "value": 68736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794416, "uuid": "42f6469a-1a17-433e-8ba9-d5f69b6cdb16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794416, "uuid": "b5f6b9ba-3220-49ab-8807-96bc20ffa196", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905543fd-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774803, "uuid": "02cd781b-6c06-429e-a9db-2188affc0be9", "comment": "Malware payload", "value": "90c76319bb8aeca124f93cce3f457fde", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774803, "uuid": "41180950-43f3-4759-8120-953eac3eb6d7", "comment": "Malware payload", "value": "4ceefacac5bb3d0f14563d1a884ddc4c48d41b4aa3f2a573e3449fc4f2f635f0", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774803, "uuid": "baa2636f-3f55-49d7-a9b6-d75c78d21dc3", "comment": "Malware payload", "value": "aac7b261acb343eb85555b60055aa002633a06b1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774803, "uuid": "ad393c55-d39a-420b-8dcb-ef5ff779c1bd", "comment": "Malware payload", "value": "2280622d126fe2fe28c899a7e5ba54f55673487a4143c2b1bf14335fd42eb3de54b34d81c6398e83e7f1ef3aca8e73a6", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774803, "uuid": "e6a3f776-8ade-42d4-9ece-1ff074175000", "value": "31D3D1D48891A330C534BEF967373F2B8E99C258B5A1C8521E5DF793360912066ECEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774803, "uuid": "7e3b5e04-0a07-4977-b59c-be9888b4500f", "value": "3072:yG1/ZWj4DSq4D44Di4D24Dt4Di4D34DY4D54Dz4Djx4Dtc4Dt4Dd4DD4Dx7:5BWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774803, "uuid": "7ce1337e-d2c2-4dc6-9c95-06a03cf38fa7", "value": 139288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774803, "uuid": "72cfe0f4-c0dc-44be-b3ce-6c5ca202e1b4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774803, "uuid": "a32ceb02-3b38-4d5e-a8b4-59ef50e09dc9", "value": "Download Report.06.05.2021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dc1af9-97d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822921, "uuid": "48e39380-6b90-4936-b843-2a844cfe395b", "comment": "Malware payload (Dridex)", "value": "b06027282a6b777febc9adf133ec6fa2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822921, "uuid": "0022cbe4-ea92-48d1-a935-8b7eae6b56fb", "comment": "Malware payload (Dridex)", "value": "4d2a8ac80da8d106c1da82f24dddb7e870d9a7e00967adadecce772c556f35a1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822921, "uuid": "582276ad-6586-426e-a298-b54202bee85e", "comment": "Malware payload (Dridex)", "value": "73d2f6f544f34798e51518a002bf7a98f79eafa4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822921, "uuid": "027f2628-39e8-46ac-908e-f84f95d60f46", "comment": "Malware payload (Dridex)", "value": "6676d914e1873495cb59e0ef0d8b98b1036bd30f18312d1e8b961b943c83bfc1aecfb070c8dcc51d54d96220b9038fa6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822921, "uuid": "12b98289-187d-4637-ac71-097a1a649a1b", "value": "5714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822921, "uuid": "e6bb70a4-f0c5-4b9d-807b-6cefe3b71b45", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822921, "uuid": "0f4f2757-6eaf-4f42-8bec-9cbba69528ab", "value": "3072:nBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:nBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822921, "uuid": "c1417798-1808-462c-850d-fb3770d2847c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822921, "uuid": "e438b4df-2597-4170-adda-2e93a0fbbfd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822921, "uuid": "d49082ff-9275-44bd-a520-7afb5c6bbb70", "value": "4d2a8ac80da8d106c1da82f24dddb7e870d9a7e00967adadecce772c556f35a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623426b3-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794482, "uuid": "390c7e09-896a-4693-b73e-dfe95bb9350a", "comment": "Malware payload (SnakeKeylogger)", "value": "4fe3676c260e160c6ae9704be33fe0f9", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794482, "uuid": "f10ceca1-a63f-43de-8d36-b7216031937e", "comment": "Malware payload (SnakeKeylogger)", "value": "4d9a9f731c24374bf9baa53d488276921ef3beb1713473a61a21f9d61b6ae0db", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794482, "uuid": "4a3b535d-eb2d-49ed-ba5e-d64acfb34325", "comment": "Malware payload (SnakeKeylogger)", "value": "1da5c4f74fad9a27f966baaad0af7be4b7890b7b", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794482, "uuid": "36a702c3-3e46-4c7e-a419-8c4923c3f792", "comment": "Malware payload (SnakeKeylogger)", "value": "5bdaa94ec64c63e9d11f5ab75f0f9e68eb016169ca49ccd6f87b6aa98e669e3ae242c70da1d51fb8a522bc8491d72bef", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794482, "uuid": "e5b8b3ac-b5f8-4c56-9d11-59ede132a37c", "value": "9D35F15135AC8BC2E07E1B725866A02113F0799EE36AD50E7DCDB3DE26B3741016FB29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794482, "uuid": "54f4c388-85bd-47a4-8a7b-8f0e7d8384ad", "value": "24576:z2jSJg6C1B5yUybdpzbWrGt6WFxfzuPa/GMdVIlWpk:z2jYAJybzSPa/GMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794482, "uuid": "688faf8c-67ba-466d-8d5d-46c550e5a503", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794482, "uuid": "734e63a0-b1ff-45cd-a9f9-108286bb1d91", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794482, "uuid": "1f329c8d-1544-4ce7-892d-86fd7e2bc136", "value": "Yeni siparis _WJO-001, pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc79b88-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617774770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774770, "uuid": "13119644-c3b1-4c00-99e7-12e17d3aa703", "comment": "Malware payload (SnakeKeylogger)", "value": "4b8f0b5ad5f61938c79ee7b8ab4b3208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774770, "uuid": "c7f5a773-a610-40e5-bc25-ae13701a220c", "comment": "Malware payload (SnakeKeylogger)", "value": "4e9d4accd47dc415c57f8c246d5e7a80b57eb0428380ec6fad4daf99e35494fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774770, "uuid": "2ff5d911-1f6c-4bb1-9038-8f93c64ef998", "comment": "Malware payload (SnakeKeylogger)", "value": "d300ff3d6dcd25aa44cde7724387d6b73aa17545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774770, "uuid": "d744b651-8d8e-4639-9bfc-34601a3cfa65", "comment": "Malware payload (SnakeKeylogger)", "value": "983491a2a02226c6b39176a5a91e850d6d564724cbd464823e6f625ea1826d2b7ba61eee360b12501fca2258c3b9b141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774770, "uuid": "f274ff29-5189-41b8-814e-ffcd98f8499e", "value": "3F15CF2E32856B75E1FE67359060016087F2A84FE321D64E7CBCDD9C7937AC1826E792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774770, "uuid": "9b5514a8-6906-42f8-bad7-3537ffe81e17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774770, "uuid": "612ff216-af6d-4584-8ab1-5f71b0295611", "value": "24576:dybf9SXDn0mLnOXwAqk9eHfuZklhTeGTKCKOQ:S9STnOq1uOSGTKCKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774770, "uuid": "326859ee-320b-4d59-8100-af26e2312f9d", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774770, "uuid": "fefeea8a-2145-4170-b480-68035c826d97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774770, "uuid": "c240b43b-c2b9-42d9-af1e-fbceb81fc286", "value": "(RFQ) FOR MATERIAL FOR REPLACE COMPONENTS FAILURE OF OIL GAS AND MARINE EQUIPMENTS PROOF TYPE AS ATTACHED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98b795a-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774845, "uuid": "e702c918-511e-4087-9c8b-88ea4058bb3a", "comment": "Malware payload (AgentTesla)", "value": "e2bceeb0f0aed47adb230cf01044f588", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774845, "uuid": "d17d14e6-522c-48c2-b39e-6e6b62e21c7c", "comment": "Malware payload (AgentTesla)", "value": "4fa158cc0fa6577b7744c71375daa38ff6ce0818b9cfc82899f7e6e46a8601d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774845, "uuid": "e2d5963a-da54-4cba-8c9e-d33302a07534", "comment": "Malware payload (AgentTesla)", "value": "5bea8eb4668c101f0645512b48da443ea98383c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774845, "uuid": "2e8028d0-e4b3-4985-9136-be37852e80f5", "comment": "Malware payload (AgentTesla)", "value": "087d284a7b7dda1179bd2b4b4b68c18a1af4641979d081f829e9049f761a3b1d1ebad62fe1c9c869b1cdfc073d6599c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774845, "uuid": "cc2b512b-08bd-423c-91b8-91b594ed1d02", "value": "F415E02B7B5C2B4CD3488E73343A49B462F49F036526E62E78CAFF6C4E2121E56161D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774845, "uuid": "4364da5c-28cd-46a6-9099-80e51bc6d0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774845, "uuid": "a92c877d-bc22-48db-b44c-883d1fa1c6f8", "value": "12288:dGa6/pIV1Fn6OAVo1Tg9Nxf10WPtfzpzY7n4NkySmwyk67Kd7z:MK65o1KrLn0MWZ/67K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774845, "uuid": "e01dfbe6-ddf0-4396-a6c4-6c4bf0e54ac8", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774845, "uuid": "cd3efd9c-6fb6-4985-909d-722c4290065c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774845, "uuid": "b72f87ff-64f3-4961-b1cf-1e9b8d9948d2", "value": "APRILQUOTATION#QQO2103060_SAMPLES_KHANG HY_CO_CORPORATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f448d2-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617772472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772472, "uuid": "36f376ec-0bdd-4836-9ec5-4f8a582f5e51", "comment": "Malware payload (AgentTesla)", "value": "b5a3c7a909b7956ca3f90310b36074df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772472, "uuid": "92024c83-c810-4069-b41e-83bfa4ac6696", "comment": "Malware payload (AgentTesla)", "value": "51c5377d6679a6a6e2cb1e9aee769cb64c40dc17c557eff90f8b7382c27196fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772472, "uuid": "7c09a2f3-6de9-4e79-b477-bbb1f70d8d9e", "comment": "Malware payload (AgentTesla)", "value": "8186807c71a3b953432e99c5c25aafb23aba7838", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772472, "uuid": "81222300-8896-440c-929e-9dd91217652e", "comment": "Malware payload (AgentTesla)", "value": "7b6d6203b5ea064abaaf08834490aed16c2408de2fd174227349ab00192a42c6c5bbab9deede5f0f33bb9944df4f8826", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772472, "uuid": "b310e438-1bd2-40ae-a0b7-1830625b060a", "value": "96D4CF146EA905C8E8EE37F51821815007BDAD163BD2F309EFB075A95A32633CE51B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772472, "uuid": "c5249b40-73c8-4973-a6c3-677777c58f05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772472, "uuid": "a0ca8a43-8f03-45b2-8df8-56e0a8b796bc", "value": "12288:JFFrp6whqob+c5yY2GVkV1Q/2h/1dTAiKMUYXb0BAYxHHbY:J3pwG+eyjGVd/2hrdbJwBASnbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772472, "uuid": "5eb74e4e-8fee-4b72-a55f-ac11ef6a24ea", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772472, "uuid": "97bd3362-3882-4491-901d-14a798fc44b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772472, "uuid": "318f4889-ff74-4728-9ac7-a2736953f908", "value": "bOkrXdoYekZPyWI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752c5f40-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811265, "uuid": "6a6e2088-c6b1-4ad5-aaf2-e8db8c24a1c1", "comment": "Malware payload (Sodinokibi)", "value": "ff0e2ce0af118bae62969a5e897b59b2", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811265, "uuid": "ef0c2aa8-06bc-412a-9b42-d7437256df25", "comment": "Malware payload (Sodinokibi)", "value": "52612bceee07152f2e2e6699b3c085149e11979f34fe248bda14e03a0d950e85", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811265, "uuid": "a180be2a-7607-4f61-a42c-c9428cd3c36a", "comment": "Malware payload (Sodinokibi)", "value": "5bc65c73cae94509905c6a4ba657a61360bb96f2", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811265, "uuid": "26069e5b-f299-43ae-854b-03be52024c49", "comment": "Malware payload (Sodinokibi)", "value": "fe468bb80c140e8328b410e48bb2b05b9d59a0231b951fd9540f59848b79dbff909e24c5b26dd6e11d98900fdd758e22", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811265, "uuid": "6c1c0500-f721-42cf-b4de-9892270f09a9", "value": "97C3D023EDA242F2D94381F7033F2F17D6BEFD721D10586AD76049489A65182EA2B763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811265, "uuid": "fd0a8f74-86c4-41e2-84c3-6552e93f1d42", "value": "031931d2f2d921a9d906454d42f21be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811265, "uuid": "6495b5ce-6ebb-4877-96ff-87632c5a086e", "value": "1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9Ds5kYk/gm729Tq2Kke:+/LPrlAZZEqIgQ29Tq2Kke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811265, "uuid": "03c420f5-8bba-42f7-8971-3e3072a99ed9", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811265, "uuid": "949a9640-aecb-4a32-8aa8-27f832fbd336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811265, "uuid": "db5a81ac-9635-4367-a25d-a22e9a219171", "value": "52612bceee07152f2e2e6699b3c085149e11979f34fe248bda14e03a0d950e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ac0887-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774866, "uuid": "e48e0df1-3ccd-41eb-a005-8ead2c268960", "comment": "Malware payload (AgentTesla)", "value": "b3a2891aa9ed727b531fab9055550c4e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774866, "uuid": "af98507b-a84d-4ddf-b322-617c351ed038", "comment": "Malware payload (AgentTesla)", "value": "526bc2e829b771d094b6c6d8a17aa2b8111e5291ca345a313a56fecd7a63b7c2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774866, "uuid": "3d6382cd-aa45-466f-b3e3-9c6070d59ee5", "comment": "Malware payload (AgentTesla)", "value": "6368e380e78cf6c52c5d6ed11c0f3ed7d2c8c742", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774866, "uuid": "d9c09abd-424d-4f7a-9174-28cbef9007cc", "comment": "Malware payload (AgentTesla)", "value": "123d7baf10b6b94f360bdc705f4fa5ffb3d344c5d57a3a80318665468f2812010a0e0cfd6fd61dc6e848fe1223eff7e4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774866, "uuid": "5ef4b0af-6e37-407f-809e-c4a7a415d1b4", "value": "114423274356C097BD3AF4F48AA5A590C3B83F5D2776C6B3831E62205F6361D0AB52B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774866, "uuid": "019c2d08-616d-405f-ae0b-53dddc879eba", "value": "6144:4qKTZ888T8vYQPohUBtjMNwQYKTIx5rOT+R+NLFaWPWMXpUFg1JDzzw6bk:7KtL8gvYVUBmNwQgXrOT+UJ/Z11Jz/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774866, "uuid": "3be4ccd3-8530-4d8d-a717-d9ebda0fde9b", "value": 266617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774866, "uuid": "d08e9a4e-e335-463b-ad99-ff184bd5f7ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774866, "uuid": "58694ba7-291a-46f8-a0cc-d06e02f5d9cb", "value": "DHL_SHIPMENT_ADDRESS_CONFIRMATION_00000001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b701ef3-9795-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617795249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795249, "uuid": "b47c55f0-36ad-4434-91f4-d21df3dc1cae", "comment": "Malware payload (Gozi)", "value": "53c8724991b2104f154971cef10e3d20", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795249, "uuid": "cab41d60-2cd3-4e47-921b-e4b49ef92466", "comment": "Malware payload (Gozi)", "value": "53c3edc5625879745d8e80d12e6396e82fd28ec11f15283dd33e65443788d4f1", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795249, "uuid": "85cc3cc0-5f93-47c7-b8be-13f62edeedda", "comment": "Malware payload (Gozi)", "value": "45d097014c09400346de30873db0aea9576def9d", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795249, "uuid": "17bcad76-d5af-4256-ae4d-7fcb62985236", "comment": "Malware payload (Gozi)", "value": "9f0507fbb47c4101f97b040ee4a4e1ea565a42db93a4986adaac765c2a2157d75e53545ebc1dc7c90114e580a34a5679", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795249, "uuid": "32b1a713-1488-4ccd-8637-8559dfc77245", "value": "3B03C09FAD79DD1EC1F6047D99A848E426180E00D113EA6B3D10B3D926D34F34B9BBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795249, "uuid": "b4a3373e-04da-4de6-a801-fb864aaf2d3d", "value": "768:bTNIjJRuIhyehySDfSURzXO+iBMKhu7eFaR/ZJ3V93thchb8ueH9nO2:ObJUehlqUt+++MSuiFEZlthYBedO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617795249, "uuid": "39fe125c-ca85-4c42-ac57-726108253c98", "value": 38459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617795249, "uuid": "6450d269-5bd1-4095-9ee5-693bfcd38e03", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795249, "uuid": "e1b9e33a-aa4f-4493-94d0-a6ea05dd0ae8", "value": "774674 .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72adb1bc-977d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617785061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785061, "uuid": "e594f98e-55cb-4c96-b142-f980bac97e72", "comment": "Malware payload (Formbook)", "value": "62be6b2cd5931c56e229fc95a7452089", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785061, "uuid": "aa7f22ef-42e8-476f-8ad4-2dab5e974e43", "comment": "Malware payload (Formbook)", "value": "53cd0bb46c1d8aa4dc128569b2c2b2b13f0d4a1357e464e5eec019a7f11195d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785061, "uuid": "0ddc3eea-db17-4baa-ac06-301358368fe4", "comment": "Malware payload (Formbook)", "value": "95a7005a45a975958e0bef9dd50411e233993056", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785061, "uuid": "7c707516-6c6f-40d7-8746-750dbb8ccf47", "comment": "Malware payload (Formbook)", "value": "2960daaa7014ac7c887b1a110c66e06870929b7e97844a43f1d7a44259569142fcf8e9cd31bb971c178eafffb87d872b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785061, "uuid": "68c90106-fbd3-4a6c-b13c-533ee1991de9", "value": "B2B498D1F19088DAED6B09F1BD2BA5302497BE9C54A4410C569EBB1B76F3342309FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785061, "uuid": "7542e55d-5328-41ef-8527-aa12b46b51e9", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785061, "uuid": "ef4f2d44-697e-422b-8bdf-2c8d11d320bc", "value": "6144:bDIEoNQiQZY0UI3nKYTdetXSHmU1gPWbTtiym:mQbZY0UIXK+dACHmUXTzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617785061, "uuid": "6dc0306a-47ab-4194-9ad5-51fdfd99e9be", "value": 524029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617785061, "uuid": "41256e23-0f73-468b-847d-e6165bde59db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785061, "uuid": "ea5133e8-7be3-47f8-8d58-feace2032d59", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b1c202-9764-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774495, "uuid": "64dc03dc-66fd-48c9-b0a0-d3df4a25a8fe", "comment": "Malware payload", "value": "942a6f8fe49e0bf3cec399c7e39600b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774495, "uuid": "c9e4c826-22ec-4ee1-856b-7c6c849883a5", "comment": "Malware payload", "value": "53dcc6b98d2356c9a5f68b314edb8b819b99cec4ef2f6db0cfba72fb86a55d25", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774495, "uuid": "e0b88527-b232-4825-b46d-0eb474282e77", "comment": "Malware payload", "value": "7061c673466d29ee92fa9b71b3479a0572152740", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774495, "uuid": "4b73f654-e083-4254-a219-1ff080f95542", "comment": "Malware payload", "value": "142bfdf21aa4c23aa5ddec034fe8e4551afb3caa0c8c608b8b0f6abb0f262e689d0db40de115d576db9aa6f69a92aa05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774495, "uuid": "f108cced-5538-42f2-a0b2-069165a467de", "value": "B763F71CF67AD38BC2140A3D4B87A1E626283C159E8A72F631C537FFDD36645B92E211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774495, "uuid": "29785d4c-cdf2-477d-be88-49a177b58bf7", "value": "384:LFmrKkwCHJFAytiegfTMa1Wwd1C9B5Ef:MwCTtirfTMaYw29fE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774495, "uuid": "d3617f76-dd3c-4fc8-b752-f8dfc1240caf", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774495, "uuid": "be9f3461-1b1f-4bf4-9652-bcf42b978249", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774495, "uuid": "a73b0845-cd2c-464e-af3c-5ae58db7d570", "value": "SecuriteInfo.com.Heur.8975.27400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308c3a01-97e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617831336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617831336, "uuid": "05b37c50-92dd-49f1-a04d-14da67aa3dcb", "comment": "Malware payload (Loki)", "value": "7f7d7ef624cf260f3dfbc50ce8571868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617831336, "uuid": "e285ce65-cab6-4226-830e-33f6f8855e62", "comment": "Malware payload (Loki)", "value": "5478a1009c4c00f044f5418d7a9e5240bfd7a6fe69ccf3ed2577e6e11c1517ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617831336, "uuid": "7fe9ae88-b651-47ed-9921-b568c43e12f1", "comment": "Malware payload (Loki)", "value": "21ce9d4ecb31e9104aa3680913edb0d129643bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617831336, "uuid": "19b37009-a89c-497c-b783-01b1c8e8b516", "comment": "Malware payload (Loki)", "value": "7c845a544613b294cbcd876905671102fcab16262bab1afe47aa0adb5f46a46b45af8f3db7d0d132b2e2a8e7b0fc8ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617831336, "uuid": "1213a1ad-06ab-4a0e-94ae-c7e61ad5ebb1", "value": "B305E0666684422AECAB1F30482356A50273FE053E2DF79D6CCD721E1F7B7D78712292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617831336, "uuid": "08be57a2-3602-4de4-8bca-c77f1b4a0b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617831336, "uuid": "55ef872c-a0d9-4993-ba0c-d8f7a4b35e14", "value": "24576:FY5ikvSIRgIylPzLVFlAokww5a0i+hCEiGOFQrwddddddddddddddd55Lxdddd5h:UxSWk2ojw57i+hCLGOFQcddddddddddP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617831336, "uuid": "8a8f89ee-587c-4bbe-8401-b74a8fafb093", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617831336, "uuid": "7f749698-8b11-4cc6-a2b7-efc788ff2bf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617831336, "uuid": "bb6edf34-644e-4fda-b007-86a84d8adc68", "value": "7F7D7EF624CF260F3DFBC50CE8571868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd5fe48-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617772547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772547, "uuid": "f791bc95-d8f0-461d-809f-e90091b3b84f", "comment": "Malware payload (Formbook)", "value": "12f29988615ba1b851b1b5a528f446fd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772547, "uuid": "93186ac6-b44c-401f-8ea7-d695132ac227", "comment": "Malware payload (Formbook)", "value": "549f145325d458b0f9f66368926ea22167fb6825f7c5146e68361c28071179c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772547, "uuid": "ba450735-337a-4451-9fa5-5e1a96e81178", "comment": "Malware payload (Formbook)", "value": "68d73527187dedb41a58ec2a7f3fc1c6177db029", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772547, "uuid": "938ce430-bbb1-4588-a6e0-242d09ae3ad2", "comment": "Malware payload (Formbook)", "value": "3562022bd4ebb639e3ad738a54c6cd6c70d6645b9ba82a3f8b235d326d2d3c7ac9999982193f0b0517766f247e7ecca3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772547, "uuid": "dc6161f3-78c2-418d-b24b-f78a622d7dd0", "value": "4A24232BD490C2822A15F4DEE52074481827A8DDE6A88FD6EC71860AF572CC65FC9FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772547, "uuid": "eb823265-789e-46c2-a7e8-eb5553681df3", "value": "6144:nxI6NS6caUJKWUO+LFbeVqNMLZpFsWsFqkn3JVzBZx8pS:nrNZcaUJKWCekNUP2FFqMJ5Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772547, "uuid": "79ed1b8e-4413-4048-acb3-05051641edc6", "value": 215110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772547, "uuid": "046dd356-a500-44ec-b251-e5e6547a9f48", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772547, "uuid": "8c7b098a-d562-4e3d-b6d7-55affad98201", "value": "IMAGE01.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99cdc04-97c1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617814413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814413, "uuid": "5abb6959-747d-476e-85c2-c55208b38b13", "comment": "Malware payload (AgentTesla)", "value": "fd50805991d8a2f1a74ce45076853829", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814413, "uuid": "ed00a0c1-8fe2-4702-a7f9-f2cad06e9fc2", "comment": "Malware payload (AgentTesla)", "value": "55dee6475ed6ea1cfb43a31212f428175352d010544945ad7cdc5341cc388da4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814413, "uuid": "18e6228e-d99c-4088-b168-bbe243aa3401", "comment": "Malware payload (AgentTesla)", "value": "de655b5532dee699c354a2bb56558fe8576f7578", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814413, "uuid": "64df183a-bffe-4fc4-9630-48db503426ba", "comment": "Malware payload (AgentTesla)", "value": "82fc9e740f509b801e561deb4278e9f366cda1c1dbae49d4c8c4cd8dc9450d08d47b4d37a37cced42cd351e4874dc696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814413, "uuid": "f72be60c-ee95-4969-80c8-8ef2da547190", "value": "D90502257746CF61C46D07B6C9A744034371FCC86823DF5A0A58B2EA3836B8D5DEADE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814413, "uuid": "0e80ede4-cd20-41f5-8d2a-62328a4bd408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814413, "uuid": "f07a8ee3-e76c-44f8-a402-4c2e67b4551d", "value": "12288:gp7slU+yzsNm/n7Gv7HxxwTgIOzH9ZRlimsIruH7H4aCLh0HSVdE8bId72v:csllhg/nqrxugI6P6bIL2cdE8bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617814413, "uuid": "5255b0e4-d102-4c4f-b5c9-9879949e50a7", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617814413, "uuid": "7210aa6a-ece6-4c28-9b28-14f0c18ad0a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814413, "uuid": "c07b86e3-ddab-4420-b137-8bf2fcf71457", "value": "URGENT INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad8b38d-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617768378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768378, "uuid": "89248d85-044e-4cfc-8b74-a6d8ca492f85", "comment": "Malware payload (SnakeKeylogger)", "value": "19f526b635706224f407b1b953df5233", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768378, "uuid": "759946dd-1f93-482d-9040-f54e4c8f5fd6", "comment": "Malware payload (SnakeKeylogger)", "value": "55fbb7084b0ab0caadf569deb718fe3b2981f3906041f55727fd60eed977bf1d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768378, "uuid": "f4107af6-36f0-480d-891b-f2ae992d15f0", "comment": "Malware payload (SnakeKeylogger)", "value": "e824daf16a95b4762f8565110f11ae9319a299ae", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768378, "uuid": "d54d4a7c-1d3c-4840-9033-73bd84d56eeb", "comment": "Malware payload (SnakeKeylogger)", "value": "d9c9321067f520a3e16eec6fc7636c257ddcf17679f0c7ccd39852d4f33702d5765f0c1bc7b40b3038af8bb114a25052", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768378, "uuid": "ba5c9e65-9ec5-41d0-857e-15199c47a796", "value": "4FF4BF423185DC9AE44328F258AFD53050797DDE8165CA0E3787BF2BA6E7342349B78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768378, "uuid": "4d320b73-cde8-4d32-93ce-c6288bd23b13", "value": "12288:mSityjK6zSWccuhCerhNe0os/bOdF+SOJjagCux+N0PqI0nSG:mdH6SWvugGh9o+qIJj4uq0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768378, "uuid": "10557279-9b5e-40df-84ec-3755463c1728", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768378, "uuid": "677bee02-fd6e-4840-90fa-c67631a10e60", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768378, "uuid": "02a11a65-8439-4422-9102-6e9afb71266c", "value": "PURCHASE ORDER-34002174,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d946c5-9754-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617767353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767353, "uuid": "b784198b-e5a6-4353-bec8-0b48461e57e1", "comment": "Malware payload", "value": "b80131ec20b69da33dec1c7341f52e05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767353, "uuid": "852a0ca7-2895-4393-98f2-8495042fb74f", "comment": "Malware payload", "value": "59dd900bd489a495491ced38eff580d3b1708c3586d006f3972fd6a44b2e5a45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767353, "uuid": "4d93e500-de0d-4151-82fd-1ac949bc3cea", "comment": "Malware payload", "value": "829e3833a66474089639fecad112b8e94efe542e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767353, "uuid": "75e51756-c67a-4385-b897-935248ff2d9f", "comment": "Malware payload", "value": "fd36dbc88f19f50efcbb154b7bc28e2ac61eadf8a0132c471caf2650dbd7834603e886ba968eabd40424c5c2dbc89cba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767353, "uuid": "b7f31263-82bc-47ff-a31b-352b232959e0", "value": "F253A3187698D219E0260F338EC6E7F63779BC046F89433B3254332F6D776A29A25754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767353, "uuid": "b62926e3-cac9-44ec-8f85-4bb37b9119a9", "value": "384:QPwq94FfwRCUpwhvcQ0omYMCHG+TNclFo39D:Qafcyv7MCmocjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617767353, "uuid": "05930d14-ba5b-4153-b8c5-a1a62282a325", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617767353, "uuid": "664c49cb-bb54-4b88-affd-da5545445520", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767353, "uuid": "a437272d-0489-45cd-8810-5a2a32fd9ed5", "value": "SecuriteInfo.com.Trojan.GenericKD.36646107.29638.22367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3470e001-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794406, "uuid": "b380a2d3-8ec8-4128-afb9-ed0f44a30744", "comment": "Malware payload (AgentTesla)", "value": "64fa62c8ae06d33ae08bc07e8bfe6780", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794406, "uuid": "66245a4c-31d6-4ae0-8378-bedb3c2286a5", "comment": "Malware payload (AgentTesla)", "value": "59f881b49e4e52314894f5d316fc1dca052f14e54964f2ce6e0a8192c0623eb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794406, "uuid": "f672cfbe-af3a-42be-9b3d-a5a3461875ab", "comment": "Malware payload (AgentTesla)", "value": "fd46cd5fa3276518d40ad3213f6cb5ed1b30122e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794406, "uuid": "0110b218-a5d6-4d8d-8c01-1eccd8a1f7ba", "comment": "Malware payload (AgentTesla)", "value": "b611bf3007010435233b67421522257ebffab72b0cf4c7645775cc200b11647d8cd3521226b8d6646a7124f9fa4111e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794406, "uuid": "81ee5713-49f5-4489-ba3a-d55be0f46d03", "value": "FC05013F65044F57D13C10B6028682902BF8EE9A564BE2693DD273EA45F170327BFA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794406, "uuid": "c23fc625-0a85-4383-a0b0-b80ccf3baf2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794406, "uuid": "9b5931d3-1ba4-4c85-9acb-31f4a74a4c14", "value": "24576:8jqo3AqS3hIW7oQa3Qb48GxsRltEc3GgOzEyGe1ji2sAM1m:kQbDPRTUzEyDgAM1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794406, "uuid": "b7f2d891-5229-438d-8f56-0da18dceab27", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794406, "uuid": "a53989d1-8a52-490d-8b90-596831cbd572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794406, "uuid": "5ab6261b-54f1-49d8-9164-ad6425f9e2c2", "value": "PAYMENT SWIFT COPY MT103.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d7bc65-97d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822699, "uuid": "dfc57a30-5607-4587-9ed4-eedd5eb85e64", "comment": "Malware payload (Dridex)", "value": "ca70efdcf9ec0eaa61a8e1a8085721b0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822699, "uuid": "36ab58bf-48d4-49b6-9bec-8393dabbc3ee", "comment": "Malware payload (Dridex)", "value": "5a8cc33d77574a3b11ab08816f01d5f87d9a318956832b936f9aafb02d4274b1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822699, "uuid": "66c6f3e0-0bcb-4640-804c-f78f019d3007", "comment": "Malware payload (Dridex)", "value": "7e4c9e2e33e4bb571d4c8d2ed72a790d62e5bed9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822699, "uuid": "1720f710-49cb-429a-bf6c-287edc778a47", "comment": "Malware payload (Dridex)", "value": "106ce9bb7773cea8b75d3e56aeac9b909c5d5af7edb14907da1b36b9f6667ed702f312a2a0bd0204407a01e77088a440", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822699, "uuid": "1b402698-0597-43c3-97d8-c05321a97211", "value": "CD14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822699, "uuid": "3375f76a-cd8c-45af-aa24-fbebef40b33d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822699, "uuid": "b2b04754-d348-451f-838d-e8bd3fcc8abc", "value": "3072:wBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:wBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822699, "uuid": "5e83d283-3f1a-47bf-9ef4-d81735d832b8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822699, "uuid": "be6e3b96-ee63-4623-9776-1586a6866dca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822699, "uuid": "88b529bf-f003-41cb-904a-6ad79bc9a9a0", "value": "5a8cc33d77574a3b11ab08816f01d5f87d9a318956832b936f9aafb02d4274b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d0b1ab-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774951, "uuid": "481f005f-5960-4ece-a78b-bb714e7cfa39", "comment": "Malware payload (Formbook)", "value": "dfc61d7aa5d2f2d7bf68a08749d39324", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774951, "uuid": "2f1c4de3-07ed-4c5a-91c7-b458ee38ecdb", "comment": "Malware payload (Formbook)", "value": "5bd732ff0414ba8034f553e571b6f2cbeafeeae28c552b364e7ffc49854163cf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774951, "uuid": "02b31e39-302d-4ba1-8146-1fc94b5e398b", "comment": "Malware payload (Formbook)", "value": "a2392f3fb9a1d1e95724d9cdac1ca133f45e653e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774951, "uuid": "45f1fcd5-0bba-48bc-8106-e2789d2461a5", "comment": "Malware payload (Formbook)", "value": "f535ea1d91ebf640254c0002600d5be52968d2b3c72032c8b99edb8d2ce807e8ae2e14498e09d89dabf0c3f86988f126", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774951, "uuid": "4e1652c0-0ca8-4f77-bc9e-4e81e186f540", "value": "C1F433AF53206E6E424B3EAFDD7DB50A38A67CF41E8EDE549D3353058AE90914B43B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774951, "uuid": "25583cb1-a709-4272-96a1-702c980e734f", "value": "12288:HtlM3A3VcqnINL4evMgDr+E5dbZtIlzQtvroApc/lAmn6DxvQtkwqJ0iu6pmjT66:7M3ABIwGr+E3aclrooOuK6QkGh/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774951, "uuid": "c315dc08-0344-4b4f-b55c-fcc4086d3457", "value": 775931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774951, "uuid": "b458ed24-43c2-404a-9773-2bc334973c53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774951, "uuid": "6a0902e5-9f01-4224-8320-809bb98add72", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b545c985-97f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617834994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834994, "uuid": "f0b8ae53-2959-423f-9007-95852e355038", "comment": "Malware payload (AgentTesla)", "value": "bd011467a29d9d76ca46bb31172e5048", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834994, "uuid": "945a8084-b140-4b81-a2e9-c3c1204c4f67", "comment": "Malware payload (AgentTesla)", "value": "5c29c36108ddacf9bb8a014879d2683a7b63b304d4a2c381cafb1477ef7112fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834994, "uuid": "89cbfda4-96d6-435b-88e1-76a368f616c4", "comment": "Malware payload (AgentTesla)", "value": "7a11c12a8a0d73c1da1e38f7f63925420db6acb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617834994, "uuid": "8160415f-386b-4c53-8d1c-cde7fb729062", "comment": "Malware payload (AgentTesla)", "value": "12850e86e97bfe3854297f40324d5a2ef143f1be42767ce755339e444f84b9b6c6579e2b22a62c696e10e00687942343", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834994, "uuid": "9a2314f3-1a53-4b86-bc76-7218065d3d53", "value": "E6C401262748BF20E0BD1B7BC5B1850453FAFD069B33D12E6CE074AD9A72FA45A25317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834994, "uuid": "2caec508-09e7-4b94-a0be-e0c211d2a187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834994, "uuid": "263071ac-c00e-494d-8ff9-a3dc2c130b55", "value": "12288:g7/MqbcAtiB7Bfnkb94DjjfXBidtRCkaWcS5:2/hoxl26p6Rfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617834994, "uuid": "20f70e1b-30af-4d20-a63d-f5edc207f865", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617834994, "uuid": "0d25c72f-8cc4-4fdf-b185-711c2d456dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617834994, "uuid": "e3d55df7-f86e-4f7b-b57e-22627afd69ae", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe566b6-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617775232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775232, "uuid": "6198ae65-81db-40a5-87d9-fc8873a828a6", "comment": "Malware payload (Formbook)", "value": "e9f044cb6df85956132e055485c08431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775232, "uuid": "26a34e74-b0a5-4f79-a494-b273afb102b5", "comment": "Malware payload (Formbook)", "value": "5c8301f5ec2ae8cca6eb7aca8cd2578811019bcc261e16fe84f1bf7231676805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775232, "uuid": "d79bca2b-3b30-4e32-86e1-d04560d221b0", "comment": "Malware payload (Formbook)", "value": "0b22107753ee17ded4823947b3ba2ed5ca5a0da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775232, "uuid": "2ba530fd-7d88-4512-bb32-00acd9f3232a", "comment": "Malware payload (Formbook)", "value": "7259ea08335aea9a58c1f64306116b9677eb66e68db359b9ff6dc564b4e31b8e0a7140e43e1d7e3f3040d7c22787bf1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775232, "uuid": "18ddaf00-11e7-46fc-bf7a-d2d04b460fa3", "value": "C22559132EC4DA5CF0E95B3D45FC11127FA3D882962EDFCA68CB73AD0591982F161A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775232, "uuid": "c68ac81b-6218-4f16-91b1-f3c82a24d6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775232, "uuid": "708c51ff-93dc-4b0b-a088-989c6a8a4f68", "value": "24576:nVbm9FDnPNR2Rx9NzBiGresPb8mSwFkyWT:491nPNRgxnUGHPbTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775232, "uuid": "f415901c-a361-41ce-ad16-90ec13437ced", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775232, "uuid": "fc516081-36bb-4d58-b4fb-8574dabc2017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775232, "uuid": "328323f4-5194-487f-992a-f1230f6413df", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c629346a-975e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617771887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617771887, "uuid": "da9d7778-3a3a-4359-a9d9-189a25573382", "comment": "Malware payload (AgentTesla)", "value": "6e2dabd73940083f26778b9b96fca998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617771887, "uuid": "5b642e05-079b-435d-a9c8-accf0a978dca", "comment": "Malware payload (AgentTesla)", "value": "5e58173d37084f62fe59bf6859dea01e244325b7ff0a4acaa7395a58a36efc9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617771887, "uuid": "36d9dc11-5781-422e-a952-4072eb9e7284", "comment": "Malware payload (AgentTesla)", "value": "49da80ff14c9120edc8856bebaedb21e1d3d5fe1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617771887, "uuid": "c37e884c-7279-45a3-8b09-5f66dca536a8", "comment": "Malware payload (AgentTesla)", "value": "0c7d7cd524a8563ef0fa14f225d37a989c65ef664302ceab4af659a3dbd6ad58d8a248c5e907ea9a013db9a7cbbb8cf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617771887, "uuid": "f055a68f-05f3-49c0-a393-1016b96ab9e9", "value": "97F4CEAC3340B4DEC857C972CA942C65A621F1FA671BC7538017129CAA1DA8FDFD49F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617771887, "uuid": "3daf5e1a-b2c2-4a9a-b17d-232c649ebf9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617771887, "uuid": "8a6fb8b6-c267-41d1-af50-0039fe61f49f", "value": "12288:zVT2iNWaq67KaJZ07hUkSXzr6dJ5bHNC/v2sKnUZEQcELjF54SE8cbBhLNulx:zVT15Jxk7hMDr6dJFtCWsQ0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617771887, "uuid": "02697606-82d6-4ced-ba54-4039857466e4", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617771887, "uuid": "a7f276eb-caee-43e2-b732-2a479c9bc1e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617771887, "uuid": "839116e7-30b2-4405-982d-bd6e5643e380", "value": "PO #367459.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac972d1-976f-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617779008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779008, "uuid": "31c64883-b5a6-44fd-88ec-c6f6e5c26677", "comment": "Malware payload (NanoCore)", "value": "203109ad6d2efdca0bf52cab63a7ce6a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779008, "uuid": "fad99c90-f816-409f-a2a8-1978005feacf", "comment": "Malware payload (NanoCore)", "value": "5e7e5b02d1de0da6b91520884a92af6f7597fd2e39ec5b714ba089815785ad74", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779008, "uuid": "e79c2d75-9383-43be-b877-dc178e7783a0", "comment": "Malware payload (NanoCore)", "value": "471d5a99a2e8bfe03a9e119b327c45b6994ffaf6", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779008, "uuid": "1043a97a-3c95-4ca8-a823-5f70319a9c15", "comment": "Malware payload (NanoCore)", "value": "595e4107ab6ad6e9eea656535dbeace326bbf11540a20938ce12ade6c72171243171e1f9defcea471a46e3f54ffe905e", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779008, "uuid": "00ba9535-bb06-4486-84a6-45b499986a55", "value": "2C25ADE266CFA120F5E303B64633EF161260E8C316339B6755492279D25CA4C5FAB87F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779008, "uuid": "5df67d9f-05d6-496c-b2c7-d6ab5fa2220c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779008, "uuid": "2038bd29-45b0-413c-8a03-452a5e33af59", "value": "24576:m1izcvE+woErFNL01jT9p6fUyCbTEUSOWPy6bwSc:mU+wBB9S6fFQrSX6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617779008, "uuid": "f57bcdbc-8136-4b28-93ab-dc4ee8571193", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617779008, "uuid": "c122bc81-2466-48f3-9184-216783193d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779008, "uuid": "07136efa-9312-439f-9e49-28a102caed35", "value": "ANS_309487487_#049844874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835d3efa-97b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617806993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806993, "uuid": "a37779f7-c338-4444-8b41-3bb585c75922", "comment": "Malware payload (AgentTesla)", "value": "ab9c6291018dcbfc87d50f40d89561bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806993, "uuid": "9a8b76cd-28b7-4c47-9ea9-8089920819d0", "comment": "Malware payload (AgentTesla)", "value": "5ebfd90bdca02460b6e62bbc4812d42eed11356aa6c9d7d19bc73c13d8b60ede", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806993, "uuid": "b81a48f1-f36a-496c-acf9-44bc39319aba", "comment": "Malware payload (AgentTesla)", "value": "ec5b007761f8958fb9c4c1968245fa68999e1fe9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806993, "uuid": "1f3a6705-0024-4cd2-bfc7-d61525095f15", "comment": "Malware payload (AgentTesla)", "value": "3598860d0decc62d8f7d792f43893e70a4f1bdbed3a83b7a42b2e992712d311b3e693796c58e79606a48463428c804be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806993, "uuid": "798c86c0-df17-4160-a912-93e55e54f91f", "value": "3155BE70DB0C7A15D555FE7AF02196A0ED562E5B77866F047C80BAAB3CF7210CBACA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806993, "uuid": "cd49091f-b39e-4b06-ac55-7a15ccabda10", "value": "12288:aVMgCbMaQfbChrLCNS7V7Z8ePT0NtlDyrrBtgkTv4H444h:aVMFjPTwtlDu54H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617806993, "uuid": "c87676a1-2b76-40b6-a92f-cc0a9d62524b", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617806993, "uuid": "9f7071a8-238d-4a3d-9972-df142a44708e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806993, "uuid": "d1144153-d1ad-4239-9b9b-be6c95fafada", "value": "Shipment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16173a73-97a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617802945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802945, "uuid": "415e89b1-ee8b-4b4d-8589-e288a097d64e", "comment": "Malware payload (AgentTesla)", "value": "43aa62a1f9229499cfb922467b003d35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802945, "uuid": "25521193-945e-4a3c-aa23-66dca55cf9c8", "comment": "Malware payload (AgentTesla)", "value": "60ebf72039b411a6b672b15e842c6cefb1e270cb856a7d86c8155d02fd29900a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802945, "uuid": "5ec2f7d8-ba35-4e36-9c7c-164314cf55c9", "comment": "Malware payload (AgentTesla)", "value": "e1036a4270bd4b4e83832acb81ce61c3a8b33519", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802945, "uuid": "2c6fcd86-029e-47af-a849-933462763c66", "comment": "Malware payload (AgentTesla)", "value": "2be6f54820cea3a9e455001c490a8d366c4c216c9c292f852fc4809870a73bd1febe922cbc0fe79766285d2c70f71fc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802945, "uuid": "85edea9a-137d-46a9-a32b-2702c6128f7c", "value": "AEF423FF0B76F1FE109BD7F1A22D74916748E6353C18C82DF1965E16260767282A2CA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802945, "uuid": "a6edde2a-2cb4-4340-ac06-6f69b1108783", "value": "12288:XpXvp/iMIzTFknDTSNIKGJ2TGTLF/xU9SMC+R4S1RT7xpem40A10:5/p/AFlXGJ2TopU9ES1Ne0Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617802945, "uuid": "d1cd80bf-2116-42eb-b2e9-4ab2a9334eff", "value": 723880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617802945, "uuid": "f36fe9f9-102a-46b9-8c45-d345620fa9c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802945, "uuid": "656c76bf-c347-45d2-8a7b-c5b51a86e1a4", "value": "BANK PAYMENT______pdf_____________________________.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bda52ec-97ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617805504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805504, "uuid": "9356ccef-bdc3-4579-a6de-447d7d4cfc3d", "comment": "Malware payload", "value": "73bd07ee6d0c65ad0133fd69d3dd32ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805504, "uuid": "d54fa77c-cf6b-41bc-a8f5-4afc0185c60f", "comment": "Malware payload", "value": "610842f5e809996227396485a6577f350a0402cacab2ab431854ed97b83f5bc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805504, "uuid": "2b7b3d78-c0ed-4739-beb6-5144705afa72", "comment": "Malware payload", "value": "610ea208b3d86b98c40e9cdef7e12537086601ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805504, "uuid": "5a06ab5c-04fa-48f9-a702-f7042537cb70", "comment": "Malware payload", "value": "14af4fcbb409644d770aae1f1f34bed2ac7fc244135f5d5cb9862bc6e1d8972b43198aa99ed1c6abbe18af019fac49ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805504, "uuid": "3b62804b-bfa6-42c4-9bb0-86ca7a931d8b", "value": "77E423C1C3EF3596D3DAE2327051AF242E97FC999C2BC94D5E2CCB5536768820492987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805504, "uuid": "2243ffa7-98b3-4898-bdaa-21ff8ae2645c", "value": "12288:ErhuqMmpXimOY3JuLgMFZh/gi5sBoHr5HnhyYqWQM8PMq6U5uvdajqFPXjAfcGdr:ErsaiHi2NqcZr5DqQKMqbOYIYcGdg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805504, "uuid": "19e033e3-5d67-4504-969a-0aaeda45f7f7", "value": 700062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805504, "uuid": "da83a972-d1ca-45d9-9ed0-4eae103fe924", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805504, "uuid": "723bd18b-5c20-49e8-bf74-e86fe1e825db", "value": "factura y datos bancarios.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89c10b2-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774844, "uuid": "d487dbb2-f1d1-495f-89df-510c7bbd8e6c", "comment": "Malware payload (AgentTesla)", "value": "ddd5b29a63ccca6f031d825f09f3bec8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774844, "uuid": "86bd48e3-1ea5-4107-a09b-ec8676118110", "comment": "Malware payload (AgentTesla)", "value": "612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774844, "uuid": "dfecff88-70ae-4966-ac10-5e9830bde8ee", "comment": "Malware payload (AgentTesla)", "value": "9cb3de373cd75bde5e55c111a79eee662b7938f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774844, "uuid": "4b67af77-895a-4627-b08e-ce7881ae9cfa", "comment": "Malware payload (AgentTesla)", "value": "70b49a49010db744ceacede7b734c07c00ed2813e19e27c0f2b7f0a5450f8be94c9a96bc2b8006c60e3c72dc37a3662a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774844, "uuid": "eb3f639d-7ae6-4ebc-bfcc-4875e8054363", "value": "31C423D2252192123669137AB4F78D31A8371E9ED2CDF1121588170D4FDA88AFE6F27F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774844, "uuid": "de4718c2-d29c-4fdc-a7fa-da2127c5e0a8", "value": "12288:zqG8U+mb/VToyRW+MfvVc+f45dpV5X7UrGnb39DbU/wu:zKc/9o7v1gprX7HL9kwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774844, "uuid": "0af53d4b-b93f-4d84-bc67-346c3e3001fd", "value": 545128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774844, "uuid": "cace737f-ae43-4d46-8ad7-f28add200ab6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774844, "uuid": "26eb8b76-4c08-46aa-b8bd-42f75f156214", "value": "APRILQUOTATIONQQO2103060_SAMPLES_KHANGHY_CO_CORPORATION.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed20bf3-97d1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617821267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821267, "uuid": "e1eb6d89-8313-4918-973e-0be85eb4ada2", "comment": "Malware payload", "value": "41970b4413c99318af76d54e9f33fa39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821267, "uuid": "dae6b226-d726-43ae-b62d-8f3a9120cbd3", "comment": "Malware payload", "value": "6143d3d926b3811d1fe4a48232d070f516fd58cdec69ee66d350779b65c6e313", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821267, "uuid": "760b52ba-f17a-4600-84be-30be41d78fb1", "comment": "Malware payload", "value": "5fe12963a1ced85a7756a868c4c64cce461c2688", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821267, "uuid": "3858d250-3a99-4353-8cc7-fbc43d6679be", "comment": "Malware payload", "value": "66408a2062cf087eb26c38abba44a9418a26db03c3507e3aa8e1f01be37866dad8f10bc46e97effde083fced2920d3ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821267, "uuid": "89ce0f04-fe44-4eaf-bc3b-cad75f221186", "value": "C605F03023A86B49E67E97796070552017F6B85AE332E70D3DBC118E1E72B429BB3717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821267, "uuid": "ec454b40-93ea-40ce-a27f-78f11689c832", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821267, "uuid": "17f78668-ac96-4d0e-998b-6c8e172d89fb", "value": "24576:GzbrmdL/dNH+gqYtlNj7B7ky9WMqHCimRpKhM:GzKTdN6YdRv9WM2RmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821267, "uuid": "319b2d81-b078-4d54-a0d1-441009b282ce", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821267, "uuid": "552e770a-b50b-4846-8f10-ee932e2f64cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821267, "uuid": "d615128d-cdd0-4012-82a4-c4e92386f507", "value": "SecuriteInfo.com.PWS-FCXD41970B4413C9.25417.26055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9056c4-9762-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617773374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773374, "uuid": "4ba3ea8d-61c6-4880-8f31-78155f2068f0", "comment": "Malware payload (AgentTesla)", "value": "929980d40e30eeb570b14ce6781fe7c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773374, "uuid": "16c1bc92-2809-4ff2-8bab-bc186aa93ce2", "comment": "Malware payload (AgentTesla)", "value": "61b9bec815feb7f0fe00db686b9c84e62308fd2a50e61664655f56739fbb9932", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773374, "uuid": "7f46c988-4d58-41f3-a9d9-ed1ef300b35c", "comment": "Malware payload (AgentTesla)", "value": "80f7b065a272f82f00104e75856f14cd51e963d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773374, "uuid": "d452fc10-143d-47d4-abaf-decfc6c6ae24", "comment": "Malware payload (AgentTesla)", "value": "0dbf4e72074479d85cb2bb99ea1ab185b32e2035053c618822ae4938b86ccd078a3a6af6dd4d6c3736c2a6608c5509fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773374, "uuid": "ac073382-0d2f-401a-8cfe-d9dabc5bafa9", "value": "91E4235DD3FA69D1EC5C13B3C2618E596CB1652ECC23751361E8E4D0AD6332E891E0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773374, "uuid": "884cec3d-8073-4816-802a-cbb1f6a2feb5", "value": "12288:hW+AuKJhor2nWqNFVCGhWxyUnRGGfiyqQ5Y125LafmRNK3l1HJzOLA3wQ1Y:I/wrEhNFSxyUnRFaydBvi3lnzOLgwQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617773374, "uuid": "79a2bad8-5b68-4b51-a461-cfaa38df23c8", "value": 702180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617773374, "uuid": "86fc65a7-5645-4672-8584-3dabba144f6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773374, "uuid": "25ca4655-0302-4863-ac0d-32bfc35c108d", "value": "mv Sider Capri.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9809774-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794709, "uuid": "9ec4a24c-f047-4af7-b6ab-ff381982082e", "comment": "Malware payload (SnakeKeylogger)", "value": "1891b46b36338b0db1d8fd2d78d4722e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794709, "uuid": "5ad94231-4cbb-4f20-bbfd-d0dd8e5ba2d0", "comment": "Malware payload (SnakeKeylogger)", "value": "633dac67b28c4f0471fe37ee7f789d92e7239609143e6bad8f3ef7ec26af2728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794709, "uuid": "bfc45347-1af4-4d09-9f29-67b6aad17cee", "comment": "Malware payload (SnakeKeylogger)", "value": "75045bbb550699011ed86e527347732a5bef9ae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794709, "uuid": "087666c5-2755-4606-aa3a-4378fc0fa46e", "comment": "Malware payload (SnakeKeylogger)", "value": "1f3d2a7fbbb399069a21573cc7faee6f533605b6ecb1997b708f7611d16da0747695d8ecd37342f563f1beaed831f0e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794709, "uuid": "65cefbbc-0aa1-45f6-af7a-f237e9ca964d", "value": "6F047C9D722072DFC827C876CAA86C74EA61747B530FD213906716AE9A0D98BCF151F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794709, "uuid": "bead324f-915b-4d7f-9600-bd7c2c7efc32", "value": "3072:Vjf2aFUWmkqoh9/BUmIPGh5JQdhigF/3BJw+zagj/ZVdy2Uy2pxQipEbg1cnjaKU:lfZeNkqoKBqkTF/RGYjPs2Qxl6bgajat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794709, "uuid": "8599f084-0187-4d88-9f07-ceff904179fb", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794709, "uuid": "2cabd5ed-0187-4fa2-b575-ed74e2e5507f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794709, "uuid": "1986bb79-5ce2-4fe6-bf65-2acf6a853bb5", "value": "Order CG-210331-1004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5d3fc6-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617774981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774981, "uuid": "9eb43abc-b6c4-4cd0-b8e4-7967414459ca", "comment": "Malware payload (AveMariaRAT)", "value": "5d707a4553f073324b1b849b3f891e89", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774981, "uuid": "53b1b096-cd65-4f1d-94d9-4bcd9c619bd2", "comment": "Malware payload (AveMariaRAT)", "value": "63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774981, "uuid": "f007487c-e601-403d-907e-b26afa91c53a", "comment": "Malware payload (AveMariaRAT)", "value": "02f8b8b8ad01f65ac9af419de5956faa7843da5e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774981, "uuid": "02d05117-6c5f-437f-929e-d108beb24937", "comment": "Malware payload (AveMariaRAT)", "value": "918ec33d62f5c8eeb1f0b1833ba13d7cc539b5640961848e6742d83a203948f1137cc0b3efc43191e17378343cd8a137", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774981, "uuid": "fca1181d-750b-47da-93d4-c053a26b613a", "value": "ABD423FF5DD4C9A31008B4304B087CBAA74EA62A16BAC3DC511EEF7E6161DDA507486B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774981, "uuid": "9cac00d5-bf49-435e-a601-b111c46a4002", "value": "12288:rD9vFm61tXeb2A80vfZpIYPRoMoGjEgrT2Vwskc3ehhnu3sTw18a:dtm6LA803HJCGYATa3sTw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774981, "uuid": "83188f55-f448-4970-a8e5-41bb756dbe8a", "value": 616162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774981, "uuid": "9981296a-2fc2-46b1-861c-d471ceae077f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774981, "uuid": "5bf1e413-398e-47ed-99f0-841b8446b419", "value": "Arifashayan_2020_06_04_RFQ.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dac286-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824600, "uuid": "975cfb9a-d647-46ff-94df-a53ae0c3c5a3", "comment": "Malware payload (Dridex)", "value": "8e804d51c7de8ee739d6bad22ca7a4b9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824600, "uuid": "58683913-2997-40ff-ad3a-7f33395ae16e", "comment": "Malware payload (Dridex)", "value": "645cf0661f0fc95015abfe3e23dc8937bb59503f99a69369a65bb10839e60c91", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824600, "uuid": "70f0dfc9-4d9e-4843-9ccf-020f3b4e14d3", "comment": "Malware payload (Dridex)", "value": "0f3413e3511d73b7e07dc6af32d8a1717889c1ad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824600, "uuid": "3639899a-7dfa-411f-b589-2471d2215c4b", "comment": "Malware payload (Dridex)", "value": "00ed61bbaf417e241607ac60c9b4e8003140a6fdaee80e2a1080e3dc80fe3b1e2855941e01c929600be5261bef72faaa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824600, "uuid": "87410b39-18f5-4fc2-b523-029ab9c6f0d5", "value": "22249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824600, "uuid": "a1154c81-d1a7-4771-9fdb-d6814f6f380d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824600, "uuid": "83518895-44d0-420a-a28d-2189a3b38144", "value": "3072:e0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:9pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824600, "uuid": "17a34721-bd52-44c0-825d-84c1caa496a8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824600, "uuid": "eab8c2a4-dcfb-40dc-96db-44d44aec25e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824600, "uuid": "76e968b3-7a6c-43af-9e59-d1d0a7a5204e", "value": "645cf0661f0fc95015abfe3e23dc8937bb59503f99a69369a65bb10839e60c91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c8206f-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617774940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774940, "uuid": "f02e3185-d2ee-4e31-a9ce-a4c893dced60", "comment": "Malware payload (AveMariaRAT)", "value": "a71d3dabb71f27cc04a540bc810be5e2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774940, "uuid": "e05e0861-a798-478b-8bdb-cad97df45ca3", "comment": "Malware payload (AveMariaRAT)", "value": "64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774940, "uuid": "2de16e21-9773-41f0-92d0-a471b6334ab1", "comment": "Malware payload (AveMariaRAT)", "value": "4bbdada5c8037ee0924e5e59063a54c67e6c95be", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774940, "uuid": "03b300b5-1482-418a-b540-6e0b07b88077", "comment": "Malware payload (AveMariaRAT)", "value": "81335689c29e5ebd4df89d323b6f33900d8c890e0be2460a89344037d073776cb3b824a3333b077a430b6b28e072d832", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774940, "uuid": "e9624501-7a55-4194-994a-03010d35bc3b", "value": "25D42376D76D4AED2ABA216AABCCC0D8F41439F92206B04794380C9255F6F7FED1342D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774940, "uuid": "4d99feb4-abd0-417a-b009-af43e87ddd14", "value": "12288:z1n5bwc8Lp2Qur55bbKRRtNFIk35Rznrc4M+J3Evgx6DA:zIc8Lp2/5tbKX+e5Rs0J3+gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774940, "uuid": "909eff36-ecf9-4fd5-bdc0-4242298353de", "value": 610119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774940, "uuid": "a7a57c96-5ca4-4f7c-872e-79fa507f6ab0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774940, "uuid": "0c78b9b2-0ee5-489a-ab6d-66bb7f1b0035", "value": "CARASOL LIMITED GROUP PRESENTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0e9b2c-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794504, "uuid": "181e01aa-61b2-4ef7-98f2-528ede065acd", "comment": "Malware payload (AgentTesla)", "value": "a7abd5f501803ce742e4a560ff2657ba", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794504, "uuid": "2faf3eb7-c7b6-4993-b072-da2150b97958", "comment": "Malware payload (AgentTesla)", "value": "65071be9fdceaa1ee27215551ed7ebc6626b95902c461b70379394c5c94048cb", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794504, "uuid": "11cfedb2-42bd-4867-901d-e55aa267dff7", "comment": "Malware payload (AgentTesla)", "value": "4fa1ce94e98408fa3d8b94f6d918c62dab115c9b", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794504, "uuid": "971ac0be-cdae-435a-8b3c-638c46a6f78b", "comment": "Malware payload (AgentTesla)", "value": "9c9a9e148b709d12c834f951f4a21ba9b2ce9c53644024c42c573068589eea8bed93f2ee9bae375ddd0f2a45abeaa3bc", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794504, "uuid": "78d05942-0659-4073-ad71-2cce7e41d438", "value": "3CC423B570EA54F3C0F82942B42344D2BDAC5815DB6CF1672CDC92AB2BA8C5BCF54D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794504, "uuid": "6b41afaa-a2a2-4cdb-9db4-9b7062646dae", "value": "12288:gpcjaMqwvIjUhmxNHsma5HE4o7P32WIja557aGW/zX:vjPFhMHq5HE403TIjwaGW/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794504, "uuid": "4f2b9231-2f6e-4909-a8d3-d1de7df18dd8", "value": 544324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794504, "uuid": "8b7062a6-c768-4c4a-88ff-1589c69709a1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794504, "uuid": "1c77f539-f98f-450a-a25a-3e4e7f21f99b", "value": "DHL_Express_Shipment_Confirmation_BKKR005545473_88700456XXXX.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea22398-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794396, "uuid": "dae4151b-4b6e-44c3-96c1-04daa7c5b413", "comment": "Malware payload (AgentTesla)", "value": "2921cc5ff5b697c60ec090997c16c189", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794396, "uuid": "c6f2d75d-ccd1-4dcd-a18c-6c62ed04efcd", "comment": "Malware payload (AgentTesla)", "value": "65ace1baa426577604cd909b104b47b918d4ad989c2d7ee02ef23172a4b43e31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794396, "uuid": "e97450a5-2612-467a-944a-dc0e71a96348", "comment": "Malware payload (AgentTesla)", "value": "444b032515362e6b017593e0a481809fd78a9063", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794396, "uuid": "36aaedc3-e17d-4b8b-be1f-360473536754", "comment": "Malware payload (AgentTesla)", "value": "bb81228993ed2788142f2be4c2db55af52f06bb8fdcb2c5bf47fea30456b878af0c2075e86ce2d3154cb29c0108f69c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794396, "uuid": "ef5b1b25-7240-4a89-b71e-d978cf4c15a5", "value": "B6D401F47104CAA5DAFF097C7D6249357AB3F97C88A0070A34FC22985AB2BD4199716F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794396, "uuid": "5ead09f5-215c-495e-8498-025bf15ad06e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794396, "uuid": "44727607-1e63-434f-8ed3-dea68508ac7f", "value": "12288:TJvxtNug0mL2i90Q3rccrmf91iyOiyCyYP2Dm/KLtFoR:TJvxtNBRqi90Q3uf9AyOvu26/itFoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794396, "uuid": "cf796eb1-79b8-40db-9516-148ea9a7411e", "value": 609432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794396, "uuid": "556ae2c7-5005-4d35-b279-7abf34052cc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794396, "uuid": "90e932f0-e5a2-4462-bb8a-9b6fa88952f6", "value": "ORDER#944_JSH38S-2H8292DJ2-38D0X-3VH3-265V-KA50-D9300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a16b30-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824308, "uuid": "0a0ee87a-9866-49ff-9397-2e5876e7335e", "comment": "Malware payload (Dridex)", "value": "cc23722bad60129268c9707cdde60cbf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824308, "uuid": "854bd1b5-76d9-4192-aecb-1dd2a0f620fc", "comment": "Malware payload (Dridex)", "value": "65c1999d55b57e4bcd5af7cce5e6061698dc5c6dacd6c68dba2c8114925526f3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824308, "uuid": "963fa4f1-3a5c-4ff6-ae49-accdeef58b32", "comment": "Malware payload (Dridex)", "value": "6365abc3fcb29a43f6bdd8ac04faeaed39962443", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824308, "uuid": "c473a689-a403-43b6-b6f1-ac867f0ab71c", "comment": "Malware payload (Dridex)", "value": "add446eff7fe748867978f22df5586ba7ecbfc3b6094010826f26b742477a7b466d19541f50590c6a995690587648323", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824308, "uuid": "d7d41556-1320-4bbc-a9a1-07d18c437dd4", "value": "70249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824308, "uuid": "6cef266f-7bc6-47c7-877f-60811ac962d5", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824308, "uuid": "a44baf9c-0949-4de2-a475-811ccc17db9d", "value": "3072:60DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ZpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824308, "uuid": "6ba12bb0-f5c8-44ea-95f9-2fe4095012b3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824308, "uuid": "ada8d6cd-653a-47f9-9c05-17701ef67250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824308, "uuid": "4f1780af-f1bb-493d-969d-3e7562308546", "value": "65c1999d55b57e4bcd5af7cce5e6061698dc5c6dacd6c68dba2c8114925526f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a53dd58-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811273, "uuid": "f097dabf-b4c9-4bcb-8aeb-74ac7fb6355d", "comment": "Malware payload (Sodinokibi)", "value": "ee11b17a14f1b7a6b197e9f38eb5cf7c", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811273, "uuid": "023db76e-2952-429a-af33-847b91332981", "comment": "Malware payload (Sodinokibi)", "value": "66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811273, "uuid": "e79bc603-a35a-41a9-b8bf-3119ac2ddf72", "comment": "Malware payload (Sodinokibi)", "value": "7fd96ccbccac8731cc8157100740e850facebcc6", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811273, "uuid": "85678291-1740-4ac8-b765-a58f83ed1542", "comment": "Malware payload (Sodinokibi)", "value": "e8180623adb6ba33c93e91116c3cb3649ebd3695ade832999306e69cf76cca2f1d90204258f1da29d2fa586f18f907e8", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811273, "uuid": "f4c34f75-675b-4ab0-b390-f1aad00c5dd8", "value": "5FC3CF63FEA081F2D98380F7032F3F1799BEFE36181058ABD76049841E656D1DA26767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811273, "uuid": "16d5cfef-f97a-4612-a4a7-225b89ec0974", "value": "b321b6896e18906d7c1d33f3e88fe16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811273, "uuid": "a5693a4a-3d33-4eea-bf27-54d623c880ef", "value": "1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUBAfYaN317DZz+:mmV1wKdLoLC/OemUB4/N315UFfiKv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811273, "uuid": "e8a637cd-e822-4360-b4a5-cb5819be7f92", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811273, "uuid": "ab35d8a9-9c06-4220-a186-c58414957b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811273, "uuid": "cc68558a-a5b0-4eec-980a-281486f30c10", "value": "66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbfd8d9-97f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617835572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835572, "uuid": "b1f527e5-be39-45f9-bca3-4a930d103bea", "comment": "Malware payload", "value": "825fbab710f4bfbc1a0c80a56b7cf7f0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835572, "uuid": "8bd32465-95e3-47be-a856-59a4266b4716", "comment": "Malware payload", "value": "68081a431396a2876a1f57b55ebfc2bfb762abcc4feb5d29e9b0415ef415d10e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835572, "uuid": "4ad0a446-c13a-4acf-98a8-ae60ff05d916", "comment": "Malware payload", "value": "25110bff4e00ad80ca26bb38c084bbe6c2dc3ba4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835572, "uuid": "a42f6f85-b978-4001-9ae2-babfd565d669", "comment": "Malware payload", "value": "1b15aac23d22ce1c8308a47579d506282940c23575b7174a42c7d8d507e80cb25a8b92c212d9a0acb6843f5935bc4f1e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835572, "uuid": "54bc9934-655d-456f-b453-acbdbbca741d", "value": "3E64ADBCE52044E1D3DE5C33296877EC6BB0754E0727115BABEAB0AEBF119158B025BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835572, "uuid": "0b8ee416-d17d-4ca9-9094-eaa67837d736", "value": "659cb99b53c4406dda332310ca49ae1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835572, "uuid": "7ef3772f-d858-47ae-baa8-2364f4bec34d", "value": "6144:BzEfZJVX/pQEGCq6Wph5Y6p8UvsYJ9+6I/90C+OyeJjBhq:BGZJV6Ed3v6p8Uv19+sErBhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617835572, "uuid": "42668e23-bc13-4ad0-bdbd-2c149c137c04", "value": 314382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617835572, "uuid": "fa8c4012-9f57-4bb9-930e-832ce81d2417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835572, "uuid": "ea1b3b78-c34b-491c-9da4-45a2167dd4e1", "value": "68675ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b42668-9779-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617783294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783294, "uuid": "b4e580e7-6dca-4b50-9d79-a8fb91b9af4d", "comment": "Malware payload (AgentTesla)", "value": "827e07f22fd3c42c31e520d4eac2037d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783294, "uuid": "db5b774d-a6dc-49e5-8c4c-31e21993f073", "comment": "Malware payload (AgentTesla)", "value": "68a0a566de01a5160fea729317218fb78a901c2c230bb6b835a91f7be3b269e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783294, "uuid": "5f636bea-0d37-479d-96bd-6d6e1622e8dc", "comment": "Malware payload (AgentTesla)", "value": "2818e0407fd059d6b3f5ee8f8ead9c15f09d9ed0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783294, "uuid": "8a334061-20b5-4490-be83-12b665409c8e", "comment": "Malware payload (AgentTesla)", "value": "76911be532f207b4f35741018015a05be1e4a07fd52200c5b8ad9da91310b18b4f55b5c1b2d47694b32d2bd9a6038b4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783294, "uuid": "eda32170-946c-4785-b857-f8d93df95b78", "value": "6A2558232EC4DA4CF0E55B3D45FC11127FA3E986962ECFCA69C773AD0590986F261A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783294, "uuid": "3273019a-0454-4615-be79-554394137327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783294, "uuid": "2522cffd-d788-40d8-909f-c52a5ebad5b7", "value": "24576:I/SIY6MzPAzS68+Cfg8agux153tApGBiwAmw:X6WPAW6vCFB2dApGkwAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617783294, "uuid": "c502aeb1-1fb5-4483-82fa-7dc2ed72fcac", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617783294, "uuid": "ed0af430-be33-4313-99af-7e9a665decf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783294, "uuid": "8811e1fb-c323-424b-8c8c-45dc5c9a58ae", "value": "VAT INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9187c0d4-97d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823768, "uuid": "db12d60b-5f51-4795-8991-8c174874d177", "comment": "Malware payload (Dridex)", "value": "2e57811b45a68f2e0e70af0f2f3bfa56", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823768, "uuid": "02ea2d85-3de4-4e17-844c-f3ed469424d5", "comment": "Malware payload (Dridex)", "value": "68cfc7b911866fffb17e246ead8aaea2311414ad3b8fe2c69a04b177c0f957ad", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823768, "uuid": "b2302863-31bf-47fb-b05b-e4deacf46a1e", "comment": "Malware payload (Dridex)", "value": "eb89e5d525d02599a2e35d2a1f144d6095e68e01", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823768, "uuid": "411ad8f2-f15d-4f5d-8205-525ad65b8b9c", "comment": "Malware payload (Dridex)", "value": "2efc609de36201c77e4cad64ae0fa9bd06b04c0a09abe9de195ae505591c8df70dee91e3054ce665b6a1937ef49287a4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823768, "uuid": "0627e39d-4cb6-423b-8602-ed95a97f4ceb", "value": "3714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823768, "uuid": "5fe1420b-991e-4015-939e-3b8cf52fcf59", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823768, "uuid": "7e1e5587-2750-4a09-95b8-98b1a2b0d2b4", "value": "3072:HBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:HBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823768, "uuid": "dcf5eb59-d16e-497e-bbd4-580031b197df", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823768, "uuid": "a0090ca2-2aca-4f99-9f11-ceb3d307beb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823768, "uuid": "e29fa4e2-61ca-4948-bee3-1a3ee60bf8e7", "value": "68cfc7b911866fffb17e246ead8aaea2311414ad3b8fe2c69a04b177c0f957ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640e7c41-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794485, "uuid": "7bfee204-f2f2-4317-820e-1ac9a2d69e99", "comment": "Malware payload (SnakeKeylogger)", "value": "032ced3f63b6d66f82494674d5b3c44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794485, "uuid": "aa1b1e7e-37da-46ee-aaed-bc43c0688ee7", "comment": "Malware payload (SnakeKeylogger)", "value": "68f83609f52852e015998cb4b865378e0de932f9f7ae6238d0083ef1843c4792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794485, "uuid": "ce0da93f-adee-4552-9e59-bb68808d2337", "comment": "Malware payload (SnakeKeylogger)", "value": "180dec2173d050f8f164f7a59faab382873a0292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794485, "uuid": "89f191c8-85fb-4322-8e6f-c2dd1ee4a132", "comment": "Malware payload (SnakeKeylogger)", "value": "92efecb13226f3e4b7bf388749f7f4e6d6a785b1d924403bce054913caca334918873a8a6636376cb3ad67636554d93e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794485, "uuid": "82bce252-ce34-436c-a7a4-9933ed84e1a6", "value": "EF25F15136AC8BC2E07E1F725826A02113F4799EE36AD50E7DC9B3DE25B3741016FB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794485, "uuid": "db0ec99e-21e9-44ec-a07f-6017a9a6ad3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794485, "uuid": "dda7797d-009c-4c91-9a1d-333c4d730921", "value": "24576:q2jSJg6C1B5yUybdpzbWrGt6WFxfzuPa/GMdVIlWpk:q2jYAJybzSPa/GMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794485, "uuid": "56549790-b657-4181-85e1-c0233088c9d7", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794485, "uuid": "6b6cac3b-163b-4c14-8a68-316d27460dec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794485, "uuid": "d59b1dba-472a-4b05-9b45-367cd7285a9f", "value": "Yeni siparis _WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c99854-977c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617784800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784800, "uuid": "42763eb6-3692-44a8-9b24-a3d6bd155dfe", "comment": "Malware payload (Gozi)", "value": "38eee9f09cc38dad8af2cff7e9be0db2", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784800, "uuid": "a5b3b2d3-ec05-431b-b04a-ed081f096fc1", "comment": "Malware payload (Gozi)", "value": "6b9cdf009660c9ab215eb52d1dbea87d67f0f5fd913c857247f696e5227d02b9", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784800, "uuid": "fbfb9df9-f20e-4a7c-ba09-9e72ffdebf92", "comment": "Malware payload (Gozi)", "value": "dfbbb9896e9cbc991535bd1e9ba07d96a84ac91a", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784800, "uuid": "348d52bb-4460-4230-8ae2-6a758c7b8543", "comment": "Malware payload (Gozi)", "value": "b0739c458dd7d5c544940bffc9b11e07f74d7af7c731fcda37761eface39b0ed3237ec0c6295b1efd0572bd98d6ed6b5", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784800, "uuid": "c94656ca-b3d0-4b48-8a7f-7d562b0a47d6", "value": "7303D09FAD39DD5FC5F6047DA9A848E426180E00D113EA6B2D10B3D926D34F34B9BBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784800, "uuid": "579679a3-1dac-416e-b1ce-c4208ccbae2f", "value": "768:bTNIjJRuIhyehySDfSURzXO+iBMKhu7eFaR/ZJ3V93thchb8ueH9fr:ObJUehlqUt+++MSuiFEZlthYBedfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617784800, "uuid": "e2e29130-6d38-4add-b6fe-628ebcbe3740", "value": 38459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617784800, "uuid": "efeb62a5-c467-45fa-adea-6e9c66b7bfdc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784800, "uuid": "8936f161-b54f-4430-911c-3edf8010e7b2", "value": "643163 .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a39688d-9787-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617789261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789261, "uuid": "0ddfea80-f9ac-41e0-967d-261cd7c95ef3", "comment": "Malware payload (Gozi)", "value": "0deffc9d51035390ddb6e2934ed67186", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789261, "uuid": "55cd5296-ab2d-482e-bd18-8913beea9fa6", "comment": "Malware payload (Gozi)", "value": "6c99703002ea5284f603d0041f3a72b3a9e26f8f7af45a1f5e34e4297be0efb8", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789261, "uuid": "92d63386-e365-4850-8102-cd93a64ee563", "comment": "Malware payload (Gozi)", "value": "b449c2ffdd33a3c79e17c781b11be3daf4ae46c4", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789261, "uuid": "ccea4af1-4a48-4890-a579-45799e824722", "comment": "Malware payload (Gozi)", "value": "36d1e51a6f743d6f58c6baff412d67e4f8d7414123e3181565aedfe060afc51170ca927c3440d340efd594ade94f78b4", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789261, "uuid": "314ee370-cb11-4a57-a9c6-074227445800", "value": "A4059E333581C032D2722B320CA7D5E647FE79704A708ADB67A8267E1F376A05B2575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789261, "uuid": "4c63c046-9245-4c88-a82b-a6f31342be7d", "value": "565c04cd0d6065b95e9480146b8d28b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789261, "uuid": "c3ea5b32-a0bd-4ff2-9bb2-c1b3d2f2244a", "value": "12288:Y/nZIRTkvZYLNqTuFRdpqcYD/U1KY+LVQng8FQ9X1GSLpSpptpIQ58e9CZu7vZ1S:NgvZY5NDpqcYD/UoVhz7pS7bIQtgAMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617789261, "uuid": "3f2fa615-4bf5-4a7e-8af3-4aa29ab64a29", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617789261, "uuid": "4867f548-00fd-4491-9f0a-1268465d5cf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789261, "uuid": "4bf238cd-e6d1-4af5-81bf-8281bc7faf71", "value": "606d810b8ff92.pdf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bb3ddd-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617768422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768422, "uuid": "366cc96a-c631-4726-b93e-804616f46825", "comment": "Malware payload (AgentTesla)", "value": "d108de855aa2a982164cd01b7f5c08ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768422, "uuid": "52975225-5c1a-413d-a4c9-98e1498cc573", "comment": "Malware payload (AgentTesla)", "value": "6e1aaa518bf013e5edde6177d4dd09bd6a0fb6e3dfa08cb3bdcbe25f5ba53797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768422, "uuid": "5d1afb35-4bf4-41b9-b809-300fdaa80081", "comment": "Malware payload (AgentTesla)", "value": "ee9b87af0b9a5ff382d7ed7de754ddb537ac43a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768422, "uuid": "b33bd4bb-9771-4e6a-b178-bc0b8e5aff6a", "comment": "Malware payload (AgentTesla)", "value": "3154a7d50f8b399fc074fa7ce5a67433beff19331c74a75d93c693dd607ec69cc0eb39edb40a9e5137bd32a273a3a711", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768422, "uuid": "6e5c92ec-7571-40d6-b40e-1cdd0573e14c", "value": "6C25CF413245D996D4431AF288AFC5605178FDDE9423CB0E2742BB2A64F734E2CDBB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768422, "uuid": "0161dadd-c309-4fc3-921c-0cdeaea4d054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768422, "uuid": "32744c28-012d-4a96-aadc-238ebbc4d792", "value": "24576:0Rlo9huSgT8G4e6ogSlNAwms6Ya3Xl6DV4uhB2d8:0RlehuSah6jgNRmsWXGquOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768422, "uuid": "488b651c-d85e-4361-8fba-a0ece9ba69f9", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768422, "uuid": "f8cd73e9-e701-4113-8b3d-3480b380121f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768422, "uuid": "507bdcb5-fe54-4ef5-a52e-3f2fa7ae4a1c", "value": "QUATATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab8af30-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774793, "uuid": "33e83421-5c6d-4d79-b5c9-c51823c6e502", "comment": "Malware payload (Formbook)", "value": "103794ff82a8cccbeb330af1ff0e538c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774793, "uuid": "1751a4c9-371b-47ed-804d-7caa758daaef", "comment": "Malware payload (Formbook)", "value": "6ec70990f8e965d14d97cc4c2ca0544647c4a2dace3cac4cd84ea103aec1e1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774793, "uuid": "872e6000-c45c-4a8c-86d0-e396033456a3", "comment": "Malware payload (Formbook)", "value": "967273c981dccdf296dff0c3eeb7f8c34b4ea6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774793, "uuid": "e7bfd332-f494-40aa-9e06-23b214e294af", "comment": "Malware payload (Formbook)", "value": "9a4f1c6d0cc3a6cff03b0b5ad7e66ae8c8d8c5a2da8df0e6fc40f6007f5bebf6cea69014f88912832e2716f1d864e7e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774793, "uuid": "8d5e2c49-d163-4f38-8791-02bb3210d6fb", "value": "B2B369AB0180BFE9DCB150B8D955FDD182AD3EA048C198ED216117A4E2DB536F73BE4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774793, "uuid": "ffbcd3f6-ded9-40fe-97ec-60dc11e44860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774793, "uuid": "fbe92bdd-168a-4db4-bfd2-6ef1122d83da", "value": "768:UUQj9K0dXLLo826OQfDuGQxgGQk5L5VS:U5K07dOQfDuGQxgGQk5Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774793, "uuid": "2b686245-655a-43ed-bde4-37ec2ea53ed2", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774793, "uuid": "e5e7144e-2154-42d4-985d-8405a27b4f06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774793, "uuid": "f9d0205b-f019-450f-89dc-3110f5a9c75e", "value": "BL84995005038483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d40ef9d-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774664, "uuid": "7be0e9e0-e65c-4eea-b7ff-598ee735d051", "comment": "Malware payload", "value": "6015e65826f7626c9bafc81d6ba46b3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774664, "uuid": "28259481-34c7-4cb9-9489-b81c401e6c38", "comment": "Malware payload", "value": "6fef8854829df0f3fda3a4fff627a389104946230688f57526e1349dc0c7d703", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774664, "uuid": "9e240a77-20a1-4479-943b-f73e69aaf6a6", "comment": "Malware payload", "value": "a1bdbb0e6c5195e83f7a6c36eb5b56d98fc24a89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774664, "uuid": "b6b8a520-02ba-4c31-99df-6549e5880acd", "comment": "Malware payload", "value": "f2c900961d0ca09b53b528a17e8e961d088b76bfb53a264582a89b0ce9f91cf05a7fab436ed321d3de69b483b3fcb0ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774664, "uuid": "9a99bc63-1b77-4d0d-b619-f614b56a1270", "value": "115533B9E29761EBFE785D3038726EBB77ECDA204D4B604565B8280F20E8060DD1765E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774664, "uuid": "859e03a5-f9d3-4847-96c8-4acb25b6a7df", "value": "24576:/HkMGisNrnlKeazh4UkRFk4v/dX093tw+Agg6AWl57JtcMAmVx6ZNVkz:8girlIzH4v/JWC+s6AWl5ttcRmVSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774664, "uuid": "bf156e52-2d25-45ab-9654-029855f97084", "value": 1406620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774664, "uuid": "c40c2d90-447b-4b97-ae70-6ccfbff1b332", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774664, "uuid": "99cd6ea7-413a-479c-9e07-13fc889eed86", "value": "AWB-18267638920511_ES.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a263e5-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774867, "uuid": "ccd913b8-83e6-4f61-9443-6e5810130d46", "comment": "Malware payload (AgentTesla)", "value": "236af48f8d65ecc2eadba49addb3f9fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774867, "uuid": "e57fcaf4-41e4-4f28-b788-e49cde3ff72f", "comment": "Malware payload (AgentTesla)", "value": "702846aefcf07891a049c08818ff3d335b35b01f72ede73d4dc602e9260e3950", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774867, "uuid": "e0cde0c4-066e-4f59-9c61-0496d2be85d0", "comment": "Malware payload (AgentTesla)", "value": "7f938abc3ec64a9022b27d1e6a5289a0815d0a4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774867, "uuid": "f28d85ee-bd36-4196-8eae-800d6cd5dc81", "comment": "Malware payload (AgentTesla)", "value": "080e4360b0df720b4e7fa3df69cafc5d6bfd3076192f4fda0837f0a126c3002b4ecf2ab7e9e8c762ddb2e031006e11ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774867, "uuid": "af8c3357-d4d2-4858-a7f5-0d1bdc43fde5", "value": "83A4D02EBB6B7E4AC3080F3749170CAC87F1D366B067E65EBDC41DD4C92691B4A1A913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774867, "uuid": "a927e4a3-b0a9-4cfb-abb3-e2781060ae4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774867, "uuid": "4f36db82-6b6e-41ab-9702-72163e359ac9", "value": "6144:uNm+m7igwm6nVAN8Uc/n6r60/VDUSY4tuZIXJndp+gH9MrMwN:f+mvpIV1Fn6OAVo1TZIX7p+0M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774867, "uuid": "87378a75-427d-4b7b-bf3e-d30985e6138b", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774867, "uuid": "d21559cb-45fb-48bb-8437-8a12605f3d38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774867, "uuid": "8ea6fdcc-0631-4a26-88df-29cb72469ca5", "value": "DHL_SHIPMENT_ADDRESS_CONFIRMATION_00000001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cac2609-97d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822874, "uuid": "d13c271b-2507-427b-9cb5-bd49c5f902b1", "comment": "Malware payload (Dridex)", "value": "a21d74185c09cc3d27090b97621e0d49", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822874, "uuid": "d68e4b53-097c-4dbf-8998-64314572e540", "comment": "Malware payload (Dridex)", "value": "72ce5d682a15a50471978c05f515f9a724a9208a779a67fee8c7f31dd7f9f2a9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822874, "uuid": "148b3ef2-b1b5-4fcb-9d20-b606378eee95", "comment": "Malware payload (Dridex)", "value": "b4f0c424975d23d55ae5463506844136656d17c2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822874, "uuid": "521149ee-3700-491e-a01f-70328733c921", "comment": "Malware payload (Dridex)", "value": "f84e13f889f9c044050bbdf9e92daa47da2725bc267af86a2f22ae986345c9fc3e9e54c09de067571264e4cd2c3f174f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822874, "uuid": "e483620f-1f5a-49f2-988d-9c893aa1d94a", "value": "9814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822874, "uuid": "a6768130-1e10-453e-9918-d3b9c8b8e61c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822874, "uuid": "d18fa074-2794-4a48-88a1-c97b38e694a4", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822874, "uuid": "71943c59-84ee-40b9-a96d-1d615cd83c95", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822874, "uuid": "38608920-f976-4af0-8470-9c0c64215c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822874, "uuid": "a0c1adeb-1a9f-4bd2-bb03-686839a3a49d", "value": "72ce5d682a15a50471978c05f515f9a724a9208a779a67fee8c7f31dd7f9f2a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cc2fa3-97d3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617822159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822159, "uuid": "96c8b352-fde1-4af1-9de4-301fe53e094c", "comment": "Malware payload", "value": "2fb65953170888ddd2dce1b9192f04f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822159, "uuid": "1f107484-2903-41ab-acb5-eadd413ffffe", "comment": "Malware payload", "value": "745197f55db4124c5524d94e192b8de8825a76c9731170b2bdd755264478e405", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822159, "uuid": "3e5916da-9471-4876-bc43-92d45c64637b", "comment": "Malware payload", "value": "6344f493660cff14c1c668dd32ded48aafb0cc31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822159, "uuid": "5520fd46-4724-49e0-9cba-50c7dc42ca30", "comment": "Malware payload", "value": "5f07b773d0a845b794d7b48ac21ac6635796979419dda7f111b18fdf6954821657fbb2c167b66f92996f2ef7c0ab101e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822159, "uuid": "fc3dacb5-2c49-40f6-a575-477ce65b6b4a", "value": "CB0422B5B64E65E77307333CBD325870A1BBE590E018AC5BF191AEB622115FD884C78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822159, "uuid": "a574d330-0ea3-4ad0-9a9c-ab62aa6d8eb6", "value": "3072:E9EUBkv8hn6/ySMN6XH+tr3de0iPeSI+a6atf7FPwU9nPTfmJ6sOjXZ:E9znhJS66Xetrt6FI+a1twUpCJ6sOjXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822159, "uuid": "de15e383-aff8-4b49-8994-77ce42a4a904", "value": 182421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822159, "uuid": "be72554a-8644-436d-9303-eca4cef861b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822159, "uuid": "500a6c2c-1cb0-439a-a6df-f223db0394c3", "value": "Telekom.jar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b613531-97d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822388, "uuid": "12411d6a-7356-407e-8648-ece6a5cb2e1d", "comment": "Malware payload (Dridex)", "value": "d37ea75aa7d0b9617f22d7d941280cb6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822388, "uuid": "086089c4-64b3-4278-bf99-e067c915a125", "comment": "Malware payload (Dridex)", "value": "74a70dc21348ad14d303ab1ce56d33686e027492d358430d56eecace910cf18c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822388, "uuid": "5d61a679-d9c0-427d-a55e-15a66eb5e9d0", "comment": "Malware payload (Dridex)", "value": "62897e5e04194f97a5999a737545c95b927760fa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822388, "uuid": "879d9ae1-792f-43b9-93af-2db5424f12c5", "comment": "Malware payload (Dridex)", "value": "aa384183198962c4c149e12dda46ec32b55cc8d3b15c0a5bb572754d6be2970dcf24d2ecea94484e7c9c6f3fc2fe6a3e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822388, "uuid": "215e40a9-a0ff-4863-943d-c297df402758", "value": "E614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822388, "uuid": "e5eafcb6-a6dd-4066-81ee-460df757403b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822388, "uuid": "b526ad3b-6a4e-4d7a-a3bb-a8abf59729de", "value": "3072:0BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:0BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822388, "uuid": "4ee4079d-5bc9-4201-a0f0-7847e188e3cf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822388, "uuid": "56aa4e18-3ce4-4fd5-b2a8-5832d0be4551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822388, "uuid": "08a56374-d8f7-4798-9237-9e052ccc08c8", "value": "74a70dc21348ad14d303ab1ce56d33686e027492d358430d56eecace910cf18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf48fec-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617774983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774983, "uuid": "12c74d2b-f5f7-4d62-a516-74122496f8d4", "comment": "Malware payload (AveMariaRAT)", "value": "3bdd9fe778002e20e2db0830a6199bb7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774983, "uuid": "c4ba2b55-045b-45b1-8e75-a3c63c3b02ad", "comment": "Malware payload (AveMariaRAT)", "value": "757d6be9f53d159e382e9b82a4baa567d4a8173b30ccd788234f4afb5db16eba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774983, "uuid": "644b8b76-0510-4495-8994-6659972de509", "comment": "Malware payload (AveMariaRAT)", "value": "9b9b32127c5bb8b99902cd8abfe857903087a2b3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774983, "uuid": "57cf68f6-18ca-46be-9f20-0ba38686ea5f", "comment": "Malware payload (AveMariaRAT)", "value": "9eaea62e85066b9ffcfd46375643f3fcf44bca3e94614f7949b265ec8ce32a62d61c80f8027aa6ebcc136082ef9abd97", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774983, "uuid": "ae41ce23-e29e-4717-bef8-b204461516f8", "value": "C5F4F1247385CB80C46943B6D86784830775FDC96C13DFAA0A48B2E6347AB1C6DDAED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774983, "uuid": "9964287d-dc48-43df-aeaa-788bef81a850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774983, "uuid": "b53bf683-4d1e-4f02-abcb-9959d670e19a", "value": "12288:UrlXHdyzsN4pnlN52WNPKfuhksdbtUbi36yGS+XG+dMEuC2DRBH:UrlX9hNonldPO4Zba+3DNt+92Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774983, "uuid": "f28f788b-7f40-4b71-bab0-ddf532729d17", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774983, "uuid": "ee7152ad-3384-47ef-b628-0b895d1f62f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774983, "uuid": "3226b51b-5a8a-47fa-a687-c60a405d84d6", "value": "Arifashayan_2020_06_04_RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4323b7-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824623, "uuid": "c094d35e-a135-4e67-839d-f6ef7db8d458", "comment": "Malware payload (Dridex)", "value": "0a9c87a05bf80c2a24f8e9abad4f8385", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824623, "uuid": "994e3073-1210-4ae7-b92e-7fab04b2ad77", "comment": "Malware payload (Dridex)", "value": "765571b6a769b9057c09ba996c64d5ac57ff6ae1877ca3ffc0beda58e6d8fbb8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824623, "uuid": "bb7e9afa-fa4b-4d71-93c7-8da361a75721", "comment": "Malware payload (Dridex)", "value": "189f7bfd20615ba54c6cfbfe0494e95d0f575289", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824623, "uuid": "9a13f54f-d0a9-4c2d-9291-06708e20f3d1", "comment": "Malware payload (Dridex)", "value": "852e6685880561eca9e46702041c91feb6922f14617605a9db33fbcecd5df49a544d6e8196d5cbcd6027bee3a6941410", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824623, "uuid": "1c5543d2-e90d-4621-b669-ed9ba60754fb", "value": "03249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824623, "uuid": "28a958ce-a880-4581-87e8-61594a8ba110", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824623, "uuid": "b5a74544-bbaa-469b-a39c-36275a63db87", "value": "3072:H0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:mpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824623, "uuid": "27d6d008-de2e-4163-ad11-ebad5969e52b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824623, "uuid": "bc6bc586-df51-419e-ba41-aade3253bc19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824623, "uuid": "1ea75239-d074-46fa-a3c7-e94a2ff6069c", "value": "765571b6a769b9057c09ba996c64d5ac57ff6ae1877ca3ffc0beda58e6d8fbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b021d4f-97c1-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617814227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814227, "uuid": "9cc738dd-38aa-487a-9090-ed011f3d1053", "comment": "Malware payload (NanoCore)", "value": "ce3d2c6f07c0f14cf7ffcb8af7d7fa38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814227, "uuid": "f53542e6-9509-40eb-bc20-b0ceaaa9dd5d", "comment": "Malware payload (NanoCore)", "value": "76ccacc15808e1c228af17491e3cb90623807f3b5bc3828578cf9a83a7f8904b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814227, "uuid": "070ab772-3cb0-4b13-90bd-47cd51cedec7", "comment": "Malware payload (NanoCore)", "value": "ae0de88f43b79f629c38c6990e9ba563ab35d532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617814227, "uuid": "36965c3a-5619-4273-8d28-571680fdee1c", "comment": "Malware payload (NanoCore)", "value": "50908703695d960d41119650d965b4832ac05d46092ff389729d6f74ad781d79752afaf427cc474dee93d956ca379410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814227, "uuid": "b2009fab-34a9-45de-b0f9-5f5b8bd28808", "value": "1FF4687375A48783D04145F83941CBBA61BE7E014AE0A14FFEC13BFE69B93C395251AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814227, "uuid": "9317cfe5-0c42-49fa-a2e2-23f1d4caa477", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814227, "uuid": "ccd62d6e-b25f-4a91-9c7f-a81359c674af", "value": "6144:IAPLSbA+7FZRyUakmmN681VueMiXbGQxS6MgCAZFu2KnU5rB6yxv82wNH7e6c:ZuF7yUakmmNWnuPOTgOnU50882Ge6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617814227, "uuid": "323e1ba4-a1a2-458e-9675-47e1e4bbb8f2", "value": 723339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617814227, "uuid": "1f2a5612-5e7f-434d-87a1-fb1735bb6e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617814227, "uuid": "9f01dc5b-b304-4d6f-8d7f-a13c884816e3", "value": "ce3d2c6f07c0f14cf7ffcb8af7d7fa38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31796e6-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775264, "uuid": "82906e9a-7a4f-40db-ace4-a9ca1924f210", "comment": "Malware payload (AgentTesla)", "value": "f4f062343274b0e75c78da1b64014005", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775264, "uuid": "7b2f083c-83b8-4343-bf81-f95b15a51a99", "comment": "Malware payload (AgentTesla)", "value": "76e9308a21b0dde26333fd57ac54197994a60307c7437929378e0652a18034a3", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775264, "uuid": "c6545f94-ca13-4b7f-b003-bb71e1c41a05", "comment": "Malware payload (AgentTesla)", "value": "3eb8fe112895e3b7474d14d82acd74f56492e6e1", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775264, "uuid": "00a7bbac-3639-4dbb-a528-63f9c110a65c", "comment": "Malware payload (AgentTesla)", "value": "8e203680876264b5c732f22beec9d4139aedea9286ed39303c9b10face9528beb306b34635db8bd4b2557d2bedb33b22", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775264, "uuid": "f660fbb8-23a6-4734-9932-cf9d4172b752", "value": "41D423BB8DA1050C47DE2E6D86B3655197F129C9CF45FD27A802FD7C03CA68899B22C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775264, "uuid": "72f7dcff-35b3-436a-a761-3c2ef3455ea4", "value": "12288:8gm7jQE+PwohpKYOiS3KLkrL41RtiM6ltLkhNV5BEoAo:9m7jERpKYOD3KYw1RYM6lANVPko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775264, "uuid": "181b4dcd-b8e0-48fc-af17-68b39dbfd416", "value": 638050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775264, "uuid": "9556717a-61ff-4c92-987c-f53de554fbd1", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775264, "uuid": "ac2b204b-dcb1-4141-8eb4-9b598b0543b5", "value": "MT CAPE AZALEA V219 PENAVICO 13-10-20.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad62a412-97de-11eb-abe1-42010a9c0039", "comment": "Malware payload (OzoneRAT)", "timestamp": 1617826821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826821, "uuid": "492fb4bf-4ede-4af0-9666-5704418f5a74", "comment": "Malware payload (OzoneRAT)", "value": "583de02ec747f0316fb7b0e59bd858bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826821, "uuid": "c5e2f89b-dab4-40f1-987f-03fec5f07dd8", "comment": "Malware payload (OzoneRAT)", "value": "777a1b5eb79e751f4684f825ef2a5df80433a2d4e20f921d4f747e904793f3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826821, "uuid": "31c3e71f-699f-426b-8bf2-e034c71a241b", "comment": "Malware payload (OzoneRAT)", "value": "89e8b166e20db07846b4abcf81ff69c72e8a87ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826821, "uuid": "38b70f52-1b5e-4916-a0fe-314660a76c6e", "comment": "Malware payload (OzoneRAT)", "value": "1203d8c0b4b2c7cecf1e6dc7eb1d895769a715d891e144dd8cfd89fde1ada210db42a24d8ab2ff6ff88fdef28f284bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826821, "uuid": "90cf32d8-9f1b-4522-adb7-f0e860e14343", "value": "99F5DF03B6229E05C7D41F3288A7944A4B18EF26A757B74F1BF832297D721764EB03E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826821, "uuid": "eea9beca-2d98-4570-a814-b9e91555cdfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826821, "uuid": "a2135ead-c793-4d5a-aa97-ba476aaf0903", "value": "49152:GfQENoZjCa5QGch0rMxNaextS8OYkA3hkOBS2fIHWEt1HEXjLuaeJ6T9H:GfQENijB5i5xNa0bOYkAp6WE7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617826821, "uuid": "efebfaf9-0b18-4e08-9130-34cb5aae33f9", "value": 3391106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617826821, "uuid": "91629dd6-fb31-4357-b398-d1e2161de7f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826821, "uuid": "b68d7581-b815-43fc-8950-4785fa3f7ca0", "value": "583DE02EC747F0316FB7B0E59BD858BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad3689a-977f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617786041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786041, "uuid": "732c555d-62e5-4441-a28f-f94f89301cd6", "comment": "Malware payload", "value": "14f362a821980cd428528f12e691ad86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786041, "uuid": "336f3079-56f9-408a-bd22-71207da550b3", "comment": "Malware payload", "value": "7789d058979880e30a0b4da862fafd3eccf0e10c2c3bb46fe7877fb8c1c1f65e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786041, "uuid": "e12bbabf-601a-4708-9be8-b04e2bef28b8", "comment": "Malware payload", "value": "4224212bf5364b6a70246e520ae49115c9205bab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786041, "uuid": "46dacbee-3141-4037-b244-bef85757320b", "comment": "Malware payload", "value": "a0f9745b52594552a797efcc281d22f4e42c3600910b68e15072f7cd45fde98bf1885a1bf9a8ebe1acb282e6a514cf09", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786041, "uuid": "b63157ca-ec0b-4169-8b17-db049a24719a", "value": "4412D62197D482B6D9BB2E7A0C73614107B6E6049E63EF7E58C0A1164DE33C187B3B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786041, "uuid": "1e7768a9-337c-4bc3-9da6-2b4a0670052b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786041, "uuid": "29744f16-90ef-43e8-a250-a93ce4746c64", "value": "192:J/UFW3NNuGOw9q1tNuXIW1Pn/rCmioBisFvunhNb/:J/Uk9NLj2tNuxn/rCmZBisUnhNb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617786041, "uuid": "21dd5df5-683d-4579-9832-c7119948812f", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617786041, "uuid": "693d7684-51ac-4864-9fcb-353ef59020d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786041, "uuid": "30c1a390-d40b-4f12-ac7d-ca06485ec8fc", "value": "11_extracted.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1896a1b1-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617775031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775031, "uuid": "37cba9c4-3c92-48f5-b430-ba88fc3854ec", "comment": "Malware payload", "value": "c29756a81b175c8a45063f034614200c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775031, "uuid": "629f0998-929e-43d3-9916-757c3401de48", "comment": "Malware payload", "value": "77d633bb04f17dd1a4fd81ffed1f20b7e2844a0f67f16b57a6c565e429d3fc3d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775031, "uuid": "61d566e7-96d4-4d05-9f08-c63f8fe8978b", "comment": "Malware payload", "value": "2a2b6524cca0562d9e3946260e2b14161642240c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775031, "uuid": "0dec58b0-fc3b-4fef-987a-39ea228735e3", "comment": "Malware payload", "value": "64afa871cf06fa3c6367228ada5f8fbe57564fd2026986444e8131cbbb4a684800e5cec811d5ad30fbd00548a7e0e597", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775031, "uuid": "805a4848-e8d4-4487-a9c4-fffdf465520a", "value": "2A731292B05A9BCE823E684FAC6B61E3A35FF1CD54E234FF2153C9831425D5DC22E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775031, "uuid": "f88616e4-6654-4f65-a715-4850e864f7b9", "value": "1536:TY+xUjtu6cWlUWXvr7qQ+CPqwMZyVyd12MjLv5azmKu5NRY32r:TY+e46J1Xvr7qQJqwtVi4MfvDKu7RY3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775031, "uuid": "553088cb-b39d-4b8b-a54c-f190b7ab65a8", "value": 78782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775031, "uuid": "09a0cce4-dba1-4142-9dde-554f73e99c93", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775031, "uuid": "d5b0a65c-27ce-40f9-bcd1-dc8f99c651ac", "value": "swift copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a7c243-97d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617821303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821303, "uuid": "4bee1d61-f7c6-40d8-8824-e8fd2607cfcd", "comment": "Malware payload (Dridex)", "value": "2e175e28d6ba6a8608ef9eba53103d16", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821303, "uuid": "bb847061-e13f-4d40-8f55-79965ef2e1d7", "comment": "Malware payload (Dridex)", "value": "782016cb890c2ac2c17643aa6349e0b7ec25ef28f25f3973c2ba2448d1320cd5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821303, "uuid": "56299e2f-e2ea-471f-b1ab-2a5f711fbb9b", "comment": "Malware payload (Dridex)", "value": "360ac516cd5cf8ff9631bb215a1b851daaa35d10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821303, "uuid": "b51f0808-ec3d-4eaf-9dd7-e4b6d54ea4e1", "comment": "Malware payload (Dridex)", "value": "730f88aa7dabf820df6f96b41e64d68884ddc83c4e8a53a1409622e6e9e538d3f7a13bf159cca11dde8f4cec727dca14", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821303, "uuid": "86aa6711-89b9-4230-8b85-c2079e8f39fb", "value": "2414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821303, "uuid": "361997df-c64b-4cdd-87f3-db05043dad9c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821303, "uuid": "a9b6d36c-15ce-47cb-ace0-868d0bf4925e", "value": "3072:mBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:mBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821303, "uuid": "52d01b7c-b35b-4069-a69c-c58f8a102777", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821303, "uuid": "d22af6b1-dc3c-473f-942c-c0220609f5c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821303, "uuid": "5a4952fc-6f29-4cee-9897-71787e742251", "value": "782016cb890c2ac2c17643aa6349e0b7ec25ef28f25f3973c2ba2448d1320cd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25993b81-977a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617783643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783643, "uuid": "83656bd0-99f3-4cfe-a4b5-f7e45687807f", "comment": "Malware payload", "value": "4c2dd66cecd202a17b014a9ac8fbb9f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783643, "uuid": "4344bcb1-6957-4d35-9304-be9c991429bf", "comment": "Malware payload", "value": "785094cdad6fbfe00f54f40e0cd4fe70b7e1f46bc9b8b6d44a067e080fc45e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783643, "uuid": "50b9155b-bd39-4f81-8b77-c924eec68fd5", "comment": "Malware payload", "value": "11c6a2e8c9b6d4e847a3f89b582529eeebf57a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783643, "uuid": "023c5d14-892c-424c-ab0e-b99269ce17ec", "comment": "Malware payload", "value": "74ded7e398b6faf7a5f2620d5ea1575deaaab9398ca16252655775af2819ee592a36573bf0e6612048d351eec26d7d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783643, "uuid": "443ed8ef-d3b2-4167-85b6-69d3f542175c", "value": "7002F7256BD0C2B9D4BF0E760C6366820675E305CE6BDF6E44CC92224E6728547F2E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783643, "uuid": "cd6e5676-3ef5-4777-8140-ba0452057718", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783643, "uuid": "03edf9d6-0d63-4be8-b980-c7bd265feb1d", "value": "192:bgy9vNN+paCZQ1eGOwJr1tNucIW1PnarCax/34jOslmhN2/:bgCWxZQ1bjLtNuGnarCaxfAOsAhN2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617783643, "uuid": "7d30f09a-b664-4062-939e-00210f8602c9", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617783643, "uuid": "a169e145-5735-4293-93a1-1406316ea738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783643, "uuid": "55b5d022-ec4b-45c3-8247-b7614100e994", "value": "03_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3980882a-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794414, "uuid": "d771ebc5-3319-458e-a80d-c77efc3a83d9", "comment": "Malware payload (Formbook)", "value": "b6f33342084a5cfb7ed66bdbdbe7dc9a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794414, "uuid": "ac2bdc3f-9afd-4e31-9dd4-b8bdd74f43e6", "comment": "Malware payload (Formbook)", "value": "78b385290ed0c4d6d28e80202d7d91aa3ee4ef1745bac9558d8047b5937322b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794414, "uuid": "cb56a287-436c-46ed-ab60-1af4a20a73f6", "comment": "Malware payload (Formbook)", "value": "0a93ace4465b22d6c8e4b68fd688e102faecea6e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794414, "uuid": "a28aa83a-97f4-4503-bc36-b70d28d73411", "comment": "Malware payload (Formbook)", "value": "0e790b7c0285909bf1242dd27f2748d949d32d5793a2a0dc3a14feaace7aab188a890c655f8aef0814b86e5070841ead", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794414, "uuid": "17c61fed-2e59-46bc-b49b-7aee6e7e1f2d", "value": "C445DA016A4B9462C3CE54F95AF0F2F0485021A0C54A9EED5EBC7B4765F3233AB5EF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794414, "uuid": "b5497dce-9177-44ad-8e88-bc0b03bd1510", "value": "768:GERgp9K0AsiseBumyyAAypZG41eA8AgEnWVP8uMDEyUh:GERwK5lubyDypZG41h3gEnWVUuMDEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794414, "uuid": "4e465aea-87ad-4b1b-8ca9-fdd84d454e9d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794414, "uuid": "e51ed2c9-a34f-466d-90bb-d7971625c167", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794414, "uuid": "ce98fbc9-594f-429e-93bd-394359ad63b0", "value": "New Order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf3fa67-978a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617790798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790798, "uuid": "11205e26-d836-4d69-896a-a224fee20487", "comment": "Malware payload (SnakeKeylogger)", "value": "3db7a695150314adc5f834ace5cdb0b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790798, "uuid": "3183c2bd-6c2a-45f6-935c-2b1e2ef8e2f4", "comment": "Malware payload (SnakeKeylogger)", "value": "78e494cf466d16bb68b782324fa83c0f597debcce4d3bac88301b3da116616d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790798, "uuid": "27f76c31-02fc-4268-b35b-6e5686f5ca02", "comment": "Malware payload (SnakeKeylogger)", "value": "fc169b2d406f7742406e675228aef998b106ae6d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790798, "uuid": "d7b433f4-134f-459f-997c-f03897f39abd", "comment": "Malware payload (SnakeKeylogger)", "value": "f8c86ac7fb17bbc5a9828b3022544e0a616d3b432e36eb6d911f4008a436a50cfcd5a79b645d80f85a6823227e8d0160", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790798, "uuid": "e5b470ae-51df-4dc9-8b1d-0bc48d8f8a5c", "value": "10C42348814BC312AAC9D33A8EB15725E99B1E11376CB3D43122DBDA5735012A7FE71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790798, "uuid": "7ab0add9-4606-4eb2-a143-23571246a433", "value": "12288:o+QOS/vkjq7de1L18fRZXrukGSiUTFnTvtkn03WB:YoL18fLwsnTFkn0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617790798, "uuid": "34c40a8c-c454-48b1-b904-98fa1b77e97a", "value": 584457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617790798, "uuid": "8e1d2494-3106-4504-95b2-7b9f3c79a897", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790798, "uuid": "fd294c2f-824b-416a-9e5b-1a300ae23ba3", "value": "MUYR09080.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ee3bdc-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794438, "uuid": "dbb0e888-c756-4b7a-91f8-0dc1254069f8", "comment": "Malware payload (AgentTesla)", "value": "5529b4553be4e330f0b02437249026aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794438, "uuid": "b6b5bb31-8e59-4f2f-937d-00d8f4896a7e", "comment": "Malware payload (AgentTesla)", "value": "7a4afc647d8f1f6821ca28587e7a2bf49b2a317e7cef365a3cead595b1eef072", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794438, "uuid": "064c25b9-be0b-4c2e-8720-e95dce4aa0d0", "comment": "Malware payload (AgentTesla)", "value": "f1a4d66a3fa795d635bb8ebc2f5586f72d5468a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794438, "uuid": "6fd06408-939e-4c93-b033-4fcb349a79f1", "comment": "Malware payload (AgentTesla)", "value": "080da2ac0ecffb87f2bacf39f72dfd0868774452019818518d1a27daae72522f2b35c31c7a9d5632b43f3bff078a5dc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794438, "uuid": "ba0f4050-c886-4e8c-aaaa-a62cb212ca0e", "value": "6E1502222BA88F90E43E53360536A06007F1FE2ED736E61D3ED531DD2A72A455A73B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794438, "uuid": "28ca57bc-b77f-4ab2-ae48-054764bdd63f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794438, "uuid": "5bd51773-7cd0-493b-b413-dce809c2a6d6", "value": "24576:38tj+9QNck5upxbzgEyFSqtpGuA/Z68K9lq+n:38tj6QNcwuhHgujR682s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794438, "uuid": "97535158-59a0-4b2f-9c45-635d1b683110", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794438, "uuid": "093b4c9f-70ab-48d1-a1b7-97f8cd9287dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794438, "uuid": "6e98fe4e-c747-434f-b4e6-f14c07f3b58d", "value": "RFQCSDOK202140890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97671f06-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617811322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811322, "uuid": "e622c1a9-73f3-4528-a49b-b2915fdf96b8", "comment": "Malware payload", "value": "c3588bde396ca7d4d734db1be55c19ae", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811322, "uuid": "a6ec9fbe-1fe0-443c-ac64-ea43c113713a", "comment": "Malware payload", "value": "7aff8e1ba4e727f2bea9f5845ed1838db1bfc7c96802295992bc0ffefc5a0f0a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811322, "uuid": "1a86a042-3ceb-423a-b441-6afd2535357d", "comment": "Malware payload", "value": "327acf69f9fb0cb4ed514e2b42c2f2529c43ab2d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811322, "uuid": "e1bac583-4b7f-45a6-856e-9b62f5e1fb55", "comment": "Malware payload", "value": "de3fd3191ee9b613f66302025b6537489898c5426bc0357c5f0ebf578aa4217ac6cdae983140121b5ce6fe2b8b1d39f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811322, "uuid": "1e9e320e-2dde-4ade-af9c-481f1e89274d", "value": "DF6422F6109F8C67AEE8038AD5DD6723CB0687EF0A91FC14E4849CA65D5A9FF4D78060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811322, "uuid": "a4f969a1-8d2d-43d7-84b2-a3226fb067f2", "value": "6144:RAkfjLHB/itlPi67QADfHKiPUlRXoq3gNq+dL8LJXQvWiClJWxrmIa6JUrmr8jeI:vNIBHKBRXowgNq+F8LFQei+gpmDJrmrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811322, "uuid": "5b0b1ea1-49a2-41f8-89f9-071f6f7091cd", "value": 324284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811322, "uuid": "701f41f7-5e89-47b0-aff4-8cb71a888d2c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811322, "uuid": "385e44eb-21bd-482e-a3ea-c7ed36a16a02", "value": "NF-electronica-8453004902..Docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06f4ded-9767-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1617775823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775823, "uuid": "ae2bb065-e028-41d0-9462-f232c345edb4", "comment": "Malware payload (NetWire)", "value": "d49b27675f5d9c73d6145b3c64cd5ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775823, "uuid": "0b8b55f4-30da-4e0c-a932-81627ba9505c", "comment": "Malware payload (NetWire)", "value": "7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775823, "uuid": "36e7991f-066b-4e17-90a5-85843e434217", "comment": "Malware payload (NetWire)", "value": "604c0b8f966c106334744778b3c6f33d2a58c6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775823, "uuid": "883ba3c0-b464-4afb-a2bf-d768ed31bdac", "comment": "Malware payload (NetWire)", "value": "a15e7b6e25fed4b16aa83d897bf8498e8c85b3edd2f7446a4b7de2882ea990f10b94dba905b9137045869660830b89b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775823, "uuid": "48149564-d9e5-4db4-b828-7c66112fc699", "value": "C1648C1E62D474A3D0322F709471B7E04339B8645E8765CE9F852A3D2DB1BC5E8F2AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775823, "uuid": "93f6b5f7-ddc3-4236-bb7f-fd2afb6a999b", "value": "7e13866414f4ebd95471c7c78ee916de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775823, "uuid": "ad646a44-8631-4ded-b4a3-dd0e27b5dfd0", "value": "3072:1in5uw68ArDryinkLel3EpvAtzVt3SYoSmDWVimB1bFeZvYeLzvhLS5W6V3eOPw:1UAw6vTkIiAft3S1SmDwpjehJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775823, "uuid": "5d74ca6a-c524-4b96-84a7-c90fcb7ec510", "value": 310440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775823, "uuid": "b58001cf-5bfa-4178-9244-3615abc106ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775823, "uuid": "afcc2713-617c-4e12-8e18-76a0db1a90ab", "value": "d49b27675f5d9c73d6145b3c64cd5ce3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a6a859-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775214, "uuid": "90bd3f47-de3f-4374-b07b-303829726645", "comment": "Malware payload (SnakeKeylogger)", "value": "8c7db0f60114f1058474a48438072cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775214, "uuid": "884caf95-943b-4981-97e5-a19a3e690d71", "comment": "Malware payload (SnakeKeylogger)", "value": "7c98a7aee7d155bc8632cae1ff09120f88483adfa77205e6b74253e9d652e2b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775214, "uuid": "2cd5ffed-bf68-4d73-ba3e-c6141aefd0d5", "comment": "Malware payload (SnakeKeylogger)", "value": "ef5add5bcc8eaf1d33a54a3820ee67c1d32ed452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775214, "uuid": "483659a6-4292-416e-9445-f14ca7781730", "comment": "Malware payload (SnakeKeylogger)", "value": "1020fcc39d34a54ad395987b30bd358789a08f6c7e0cd48a636b1aab719695fbb2084abd958fd18983ea4fe1a174ad83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775214, "uuid": "50d49359-1d72-4e59-8724-dba917d5fb72", "value": "EF15E02232956BA6E17E67359030512083F6FD97F332D68E3C9DB19C5936AC2C362763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775214, "uuid": "6702605e-b892-40be-be17-998ae54777da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775214, "uuid": "e18a2c35-e9d2-42ff-8a96-0f6bda93bf74", "value": "24576:Krzb5N3DEp+YDnxGZC+DR/1eG8aqwdJe3zXXkbUqV:K9N3DEp+KnA0M1ejGdYb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775214, "uuid": "8a280157-9c4a-45e4-a3c7-90de3e50c264", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775214, "uuid": "a4369238-b759-4032-a321-8e4f56939e7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775214, "uuid": "e2ad4be9-6087-4b17-8474-407e0d55cf44", "value": "Urgent RFQ_AP65425652_040621,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf06d2a-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775254, "uuid": "dbf09319-f932-4519-a023-6a489f724790", "comment": "Malware payload (AgentTesla)", "value": "f0c5436d93871eb449ac9f39f4812fb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775254, "uuid": "e3107396-e63b-4391-990e-ed0541706e2b", "comment": "Malware payload (AgentTesla)", "value": "7cece5ca77b93ef7c41219923e3c080c99bffcca2141cde0acc72dc17daa6211", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775254, "uuid": "d6d7ad9f-8155-4fdf-ac21-508a5d3f869c", "comment": "Malware payload (AgentTesla)", "value": "b3cfc3250c2543e74defd9753635fe2a18f69c88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775254, "uuid": "52037e29-0260-4d15-8e43-f7f253a22829", "comment": "Malware payload (AgentTesla)", "value": "586f49da388a63c8d868caafb37fce72b74dcdfb1e93767bd1c148e25a3ddd2b159e9810a176ab4cfc54c5d7ae89c006", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775254, "uuid": "7e0c5851-211e-4f65-8ba7-58d1274746a3", "value": "A5F412363844C517EA1A4AB1C49981F913F6FC01EA1A128BB8CC7FBFBF376942705695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775254, "uuid": "4240b68f-df7a-4b4d-a693-66c938ac651d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775254, "uuid": "f6531ba8-7a13-473a-94c5-2c5a2572efac", "value": "12288:eYM/2O/hCU2croJ2ocwi17L8fyOiyCyYP2Dm/KLlrTn7xBeevAdk2K:3WhCwroJpY7LeyOvu26/il/nlvZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775254, "uuid": "4b18448e-4fbb-4ecc-a981-1bd7056c8383", "value": 741176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775254, "uuid": "21a7c9be-b6ba-4c70-8a6e-b6fabef6fadc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775254, "uuid": "3fde99fc-2d99-4647-9873-e7ab4fad38e3", "value": "SHIPPING DOCS - MV. SN QUEEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7f9099-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794424, "uuid": "599aa58c-9682-4f1e-9847-7b6eb6f64c3c", "comment": "Malware payload (Formbook)", "value": "d74a658dbde450ea07bd9f480383bb2c", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794424, "uuid": "c09679fe-1f8f-4817-a9d0-efd0b17ae8f2", "comment": "Malware payload (Formbook)", "value": "7d4195541a2b797791f0acfcbcf128612bf82271c73df0b1da860108b0638fff", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794424, "uuid": "7d13cf3c-6b43-42a3-81b4-a782dd6b4f41", "comment": "Malware payload (Formbook)", "value": "44bc9afb112a3c26906cc2e7e280335eb1cd0dda", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794424, "uuid": "6ce32b0e-9776-4f6f-b81f-2439cf661764", "comment": "Malware payload (Formbook)", "value": "897b90dac9ef1750b87589f9a159663c8c73ea587314aaef4cb07f8e47c820a49189b798b7dcc1c959df7229c741fdbd", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794424, "uuid": "ef52637a-2b76-4796-bb1a-f195e7224a25", "value": "B634129F67A9FD8088C07D30E9C9D06A93143DABEC27D3B5627D86127C5334770A9E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794424, "uuid": "b9d5a229-7e6d-4cbc-a1be-8fd16fa4db92", "value": "6144:Rkqq4jqqLRQ6+0/xFEVvOz51nyLPY9fDWeas7rywc2D6qy:RkBqVdrEVG9Ar89cdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794424, "uuid": "3ee38c4a-44d3-41ad-965d-ad70f814de3e", "value": 239275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794424, "uuid": "a7548fd9-6eb5-46dd-994d-5e5e6177fa47", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794424, "uuid": "b98f7d86-301f-4456-9d0b-6a95568b8603", "value": "46578-TR.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3b95a3-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617775229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775229, "uuid": "2135115f-03ad-4970-8329-2c5ed866137c", "comment": "Malware payload (Formbook)", "value": "9c6258d81a46e6c3f5df206c0f1d32ec", "object_relation": "md5", "Tag": [ { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775229, "uuid": "87182855-59fb-4453-82c4-d2749153a30d", "comment": "Malware payload (Formbook)", "value": "7d984f9743bf078a72a993e514f670d743d839945954e5c307e37088cee558ea", "object_relation": "sha256", "Tag": [ { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775229, "uuid": "10f4608e-bbcf-4b08-8018-bdcf6452c8f3", "comment": "Malware payload (Formbook)", "value": "169980b61894b2891b19d84e2288201198326eaf", "object_relation": "sha1", "Tag": [ { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775229, "uuid": "873362be-599e-4e6c-b715-2c05131d8cb5", "comment": "Malware payload (Formbook)", "value": "855fa97278ea0cbf5e8ee0c3da301316b2727c8f4d662cb9a94fdc8ce569e14201036cc3c3d4c581457af6a4e883683d", "object_relation": "sha3-384", "Tag": [ { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775229, "uuid": "b8069790-2057-45dd-a80f-853c07924835", "value": "1F052383912EB6D2ADB27B0CC4F07D9B39B51240243DB80C5E826770958F3D56B6EBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775229, "uuid": "6f6bc045-05a8-4a44-b1ac-2202d9e5ce26", "value": "24576:RAU/VQAXNuEHNB2RTH1zXigBes9TsmSQJkS1PnHD:38EHNBgTVygB9TDfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775229, "uuid": "208a79f6-408a-4659-9142-4cf0b753d43e", "value": 795595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775229, "uuid": "4683dc1f-a785-4885-8fe1-a1ef91c8c944", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775229, "uuid": "4acd9dc7-95b2-4c41-8260-216e650dc242", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823988eb-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775209, "uuid": "5f9259c2-b7a6-4797-adc5-406a1cad242f", "comment": "Malware payload (AgentTesla)", "value": "57e60a2791fdc098b9fa9d15bbf9decd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775209, "uuid": "b9775aae-894c-496d-9b94-d1b48e317c18", "comment": "Malware payload (AgentTesla)", "value": "7dcc941cc14464f8ade39e87ef427d4a5cd2734348c1c98c387d905aea91bf7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775209, "uuid": "a0edd81a-4a44-459e-9e3a-bb765b5cd101", "comment": "Malware payload (AgentTesla)", "value": "d11d45b5f1e360a8f3ea1d069294df0e61050d14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775209, "uuid": "a49342ef-3f02-411c-ac27-d8ef2f7df892", "comment": "Malware payload (AgentTesla)", "value": "17eef6f3491394579981b06ee6e9ecd862b86b5930ea89d389ad1c94e25b5b1700791cf40c909d50642e5fa7ea6f72fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775209, "uuid": "2b20111b-d865-4769-8c13-759a0c0dd188", "value": "B4C4F121D7896EAEDD090B7840B259350563EE7892F2134E069C78300EB7BE7275AF5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775209, "uuid": "1d4cdf17-bb6d-4a54-94ba-4225575b7eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775209, "uuid": "f2b4e898-f912-4adb-8848-9e297f00e5b9", "value": "12288:Wh8MYiSt1h3dRdoJAjMHgLGyOiyCyYP2Dm/KLl:g8MYiqx3eJUMHSGyOvu26/il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775209, "uuid": "6b267367-0309-4a37-9a75-75be17923dd9", "value": 575328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775209, "uuid": "87dddfee-4c64-4ebf-b865-7fecd2bcfab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775209, "uuid": "514ed517-dd30-4237-bbfb-d49907bf50d0", "value": "QUOTATION JANUARY_ALFA-NISTRU_20210129-20293083020234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd63868-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794398, "uuid": "ec51f061-4899-4a0b-b6a0-f42782ec6552", "comment": "Malware payload (AgentTesla)", "value": "f2ac1904d46044da303023369662b3f0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794398, "uuid": "118b8876-e812-42c4-ab23-5d2631a686d9", "comment": "Malware payload (AgentTesla)", "value": "7dee971cc909d417f623f57e012874e81534b577072789aa004547b8a3a609d7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794398, "uuid": "6f33ff16-646d-4360-a9ad-4b67d0922734", "comment": "Malware payload (AgentTesla)", "value": "28dc4860fb5269d0df581691c17f92e653996e31", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794398, "uuid": "2c44480f-887c-41a4-913f-741673749c30", "comment": "Malware payload (AgentTesla)", "value": "1588c224ce7a73a0e431423595f8449654fd218fc5d9cf2d7cc2675a3b5f70c7fa5d3d126c179bf8b5c95db1071c247e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794398, "uuid": "b056dff1-9b77-4871-9171-1c7e47c67f16", "value": "E732C02643E7140BC33B635287EA4532891D2ACB6091DACB51EB7EC39613729752AED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794398, "uuid": "74aff23a-b715-47f0-88dc-3017a922d6b0", "value": "192:ASfi2F1AxlN0y1kqyarQ5jgdlNruRdI9UrA+oKIXAd62v3gYdPrbntG8So+:ASq2Qd6a0cFafjBIQdh4Ydnh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794398, "uuid": "99e95675-12ff-48e4-865c-fe05f431dede", "value": 11989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794398, "uuid": "ace192f7-adf5-43b6-b2ef-6d10dbd12b46", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794398, "uuid": "12d0070d-db2d-4e9b-8f11-c539e6b1544a", "value": "Krishna Gangaa Enviro System Pvt Ltd.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1731e81b-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775029, "uuid": "8ad72a29-44f5-47b1-afc0-61b809ce187c", "comment": "Malware payload (SnakeKeylogger)", "value": "183b831d3fd8445d64a98f3bf981e37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775029, "uuid": "8822b2a7-d463-4c7c-9d94-99800ad8c348", "comment": "Malware payload (SnakeKeylogger)", "value": "7e585caf6d39d5596d2f74e12de5c1d5e3d00fb9eaa2341808d13fbe7db70d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775029, "uuid": "5e516b88-e9ae-4a7f-80eb-c0e67cb132eb", "comment": "Malware payload (SnakeKeylogger)", "value": "f7a67e11ccc986799eaa62a806fc71896f54cdf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775029, "uuid": "c6bf3747-c007-4601-958a-e9c50f47f3c4", "comment": "Malware payload (SnakeKeylogger)", "value": "d7ab72ff20c3b67ba028453d8d9d8d7a6f057bbece662de351ee75f3187f902604ff91dc99fa6cd583b5c7789f5063d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775029, "uuid": "e1c3fc5b-c747-48df-a4df-0faefc4c8be2", "value": "D615BE1272846B65E93EA775A030C53043F2BC5BE236D64D3DCD7C9F3972AC28662762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775029, "uuid": "557366af-a7a7-474a-bd54-c69e0af26375", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775029, "uuid": "421469d0-4b0d-491d-a524-797116e4993e", "value": "24576:L+tbtnEDn4hpxaFw/nbZTPEHi85TU4PjKyC6nK:inenAaw/nlC5TU4DJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775029, "uuid": "cefb46e7-3e47-4d60-a21d-2dd86df49dc6", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775029, "uuid": "6d40f81d-8b0c-4b37-a666-1fe0fdc2d132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775029, "uuid": "e669a0ba-5beb-4807-ac57-83494bf2cb09", "value": "Confirmation_(#1422) DEKRA order,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870a118d-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811295, "uuid": "a5f77a1f-8af6-4ea7-a200-7d5337712328", "comment": "Malware payload (Sodinokibi)", "value": "91d02943e97386a0b08f2b1219871502", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811295, "uuid": "baecfb3d-e2a3-48b9-9f0b-31f3bf9861f3", "comment": "Malware payload (Sodinokibi)", "value": "7e70460a2e395485fe6328a58e09400fc7963afeb29fdadb924c340e758b267c", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811295, "uuid": "b59f700a-bfc0-428a-adc4-d3ee71495e5d", "comment": "Malware payload (Sodinokibi)", "value": "2e219a6cd3281a8a857fc5edbb4e07f43db352ae", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811295, "uuid": "b0b8281c-7c3a-4009-8214-9a2fa6e2dcbe", "comment": "Malware payload (Sodinokibi)", "value": "b64e447022acdb4265d98d9a974d107aaf5ed9b265f89c232322736d3069abea9dd910257b5551d480bd355084ea2b69", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811295, "uuid": "3f8e410b-85e7-4d45-9ed6-2ba1a700c15c", "value": "00C3C033FDA041B2DA8381FB033F3F2795BEFE32151118ABD3614A881EA55D1E61A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811295, "uuid": "8dc979b5-5dd1-4132-bcab-3dc25be76f7c", "value": "b321b6896e18906d7c1d33f3e88fe16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811295, "uuid": "47dd0b18-a95a-432f-a821-d1ddc9611712", "value": "1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUqz+YtTru0CErg:mmV1wKdLoLC/OemUq6/orxekQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811295, "uuid": "0c027a5d-409e-4922-90fb-15de878e997c", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811295, "uuid": "d5d987b4-2989-48f4-a1e2-a6236a85e5be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811295, "uuid": "63d23b64-09da-4ead-9f8a-39f4cae6b2ae", "value": "7e70460a2e395485fe6328a58e09400fc7963afeb29fdadb924c340e758b267c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfeb8a3-9791-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617793668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793668, "uuid": "b0db36f7-c4dd-4be1-8ddf-61dfecaa088d", "comment": "Malware payload", "value": "8acfc790d8c65d345350644ceb3c3320", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793668, "uuid": "18088b56-3c25-4112-bc85-2afe710d65e9", "comment": "Malware payload", "value": "7ea790e9ffcd0b69843ab7ba49dc458c0df51952f454432008997190e764ce37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793668, "uuid": "20e6afc2-8e95-4430-a22e-0a6c3b3ab411", "comment": "Malware payload", "value": "652e5dbb9bd88c0cc081a58ed8615fb3d9dda005", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793668, "uuid": "cc4c2455-4054-47e5-bb28-3fc783d5380e", "comment": "Malware payload", "value": "9eac9428d13f5c1beccc44ea8e4b24f5b5ecff2f5d2129a0af7ab82c81241280778f0d1995e6ab10a0a6f5608f4cf052", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793668, "uuid": "7a706ffe-7448-4568-998f-1f9805befae6", "value": "AC4423015CFF84FBB8272C596B55F17FBA86240AA04EBE62825B33D4913352CF2D91A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793668, "uuid": "f3e2661f-2e17-42fd-bd7e-34345d9e71e3", "value": "6144:LfPupSWCSdJI1S7BwgEANC5+crnVBa/oOaACdGl5rPzvrl1oIenc:LfWpfCF1yC5hu/oRdGl5rPzvrlJec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793668, "uuid": "2911a284-e09e-4034-a102-69c3efb3ec86", "value": 275110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793668, "uuid": "5aed827f-f5d7-47f5-854f-7f1907397b92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793668, "uuid": "5dd39610-6870-4706-ae8b-96bbbedc2ec1", "value": "DHL DOCUMENT BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1c7e69-978f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617792835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792835, "uuid": "9302cf96-14f3-4d7c-8059-af9997cdce91", "comment": "Malware payload (Formbook)", "value": "69bfab4daf8ba8c7ae9635bcd451c0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792835, "uuid": "498a36b9-42d7-40a3-babc-153573b37fce", "comment": "Malware payload (Formbook)", "value": "7ec78d6c2c919a22185cb0000f2e273d66019b8409a3ca47c819d44cedead22e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792835, "uuid": "87666e9d-6330-4429-8e39-e8f62813a956", "comment": "Malware payload (Formbook)", "value": "a5eac3c5473a69f7d11ee6ea379c3adfc5dd648e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792835, "uuid": "49b8be36-cf27-4ca2-b729-d975059374f2", "comment": "Malware payload (Formbook)", "value": "c3e9b022c584191eee30cc31314715f60c9deeddb55321987089d063783136173c342d37710d5affd88b7222846e93e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792835, "uuid": "1b4b2f2d-4ad4-4092-a8d1-f1ddf75d0af9", "value": "3B14125BD2F1D297D6530AB0057BF73AE335C280626AFD871B298E2E5D52CD9ED0C052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792835, "uuid": "b090ee62-c657-4430-97b8-395ad2bf5b44", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792835, "uuid": "bf2b1c31-ee28-40c5-bd22-037cba5926b7", "value": "3072:NeYBCwqDxkJ0Xr6nk47BMkMs5sDVszfejTZ9vWB07w07yy17HltMYnQ786+eiN:NDItr6nkx2sDVUITSGw0blKaQz+eiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617792835, "uuid": "c017c110-7217-4462-bf7b-7e5e7f6409c5", "value": 206104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617792835, "uuid": "0edae2a6-7775-45df-86a5-bb2dcc406333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792835, "uuid": "013f3dbb-d05a-48da-a43c-3dad8a7ec59f", "value": "ALPHA SCIENCE, INC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e10cf5-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794702, "uuid": "268c538a-afbd-476b-8004-d458d316e2bf", "comment": "Malware payload (SnakeKeylogger)", "value": "1fdf46cbfea29097f35ba5f52eee2191", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794702, "uuid": "097ccdef-21a0-4b0f-bdfb-9d7228507e3f", "comment": "Malware payload (SnakeKeylogger)", "value": "805813d975f8bd6e7d867c3ff6b589c77939393d5edea5f9e4d4a7ab224eba8b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794702, "uuid": "719034d3-dcff-47fd-81e9-7a90a19686bd", "comment": "Malware payload (SnakeKeylogger)", "value": "2c913d8877c036582528c53fd0915fd462e92c5b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794702, "uuid": "592c9536-2244-4c1b-a1a3-f695db4d2cde", "comment": "Malware payload (SnakeKeylogger)", "value": "8f1a2ab8371f4cb19155feed58fe7052fb451ef53aceda7fe9496910a477afc74ea4a654b52b579da521a595dab95ce9", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794702, "uuid": "577491c4-aacb-45f1-910c-e94241749cf3", "value": "6515F1216B985B90E43E673A0531645143F2BE6ED736DA0E7DCC72CE2B37A448673B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794702, "uuid": "d57ffa60-7918-4ce9-ae32-1026c81a907f", "value": "24576:X/w2av/OunLiN8+LLq3XYlD2vB2dNMVxEqldd:X/wXm2LiN8oL6o92J2XMVOql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794702, "uuid": "4017f633-6779-4f70-94fe-65b7154553b6", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794702, "uuid": "7bfd4131-85ae-40bf-bb31-9d5ae590a24b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794702, "uuid": "a02c630b-d7a2-426c-b7e7-42e1ad039d98", "value": "PURCHASE ORDER-34002174, pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38acba1c-9754-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617767354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767354, "uuid": "55cba5ae-6088-429a-8289-bde034b61b8b", "comment": "Malware payload", "value": "37272b75ea6f3a07940ba541acb10bc6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767354, "uuid": "7aeb880e-c478-47b9-a9c7-8e638938db5d", "comment": "Malware payload", "value": "8156ce4621048984bce4875898da52376777c2380543fd353de5af5b72c5ebca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767354, "uuid": "986f48b2-8133-44aa-808a-27d2bc30048c", "comment": "Malware payload", "value": "5fbd19b0234034faa3802ed7cd7fed5b6fb2aaeb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767354, "uuid": "e380115e-e969-4468-bead-e569cb5dc660", "comment": "Malware payload", "value": "ca3e6b185e64586538fbaffc2238f0629f5a0f510ef94332b35b3cb46882a506760fd3d15520c8ac527bfaa9aaa95b71", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767354, "uuid": "990b6c82-6f19-45ab-a2d0-84d81b931e96", "value": "B753A3187698D219E0264F378ED6D7F63378BC046F8A433B3264332F6E776919A25B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767354, "uuid": "3b4405a7-a3a3-408f-9c62-9bdeff2ae73a", "value": "384:QP09rFvwQKUawHFQ0ugmYMCNqF7clFo39D:QOv9bQaMCkcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617767354, "uuid": "d9bb7903-5a96-4fe5-8c7c-5d9230f137cb", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617767354, "uuid": "caa585eb-e77e-4d03-870f-e4ae20acae8f", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767354, "uuid": "672df407-ae32-4d80-8e21-d209c912d95a", "value": "SecuriteInfo.com.Heur.1340.12595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c87c2e-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774698, "uuid": "44e6b827-ef05-4e08-a432-3a65faf88f21", "comment": "Malware payload", "value": "2479d696a8cc14b898ab0b02bbfde8e4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774698, "uuid": "8705fdd8-7253-475a-b393-136ea6bda354", "comment": "Malware payload", "value": "83a946ca558da288b427ca8efcf9a557632641fb0b8c3e278d014646ea7aac1e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774698, "uuid": "f847bfa5-1f5e-4827-b41e-54a5c10eee45", "comment": "Malware payload", "value": "2c9effb48ea9583399a9edaed73444ad387548b9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774698, "uuid": "10a90e23-d979-4ccd-9fe0-a6c7e2e6ae7b", "comment": "Malware payload", "value": "41f163c9d2d264b5d1f89053ac62a4033108341fae87ab3d110824b119f2957ef5b45c599a90c83cec7ce34c6ae00c0f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774698, "uuid": "f8720faf-214a-41e9-82d0-76c0ee42639a", "value": "6F052374E215043B97C469E24D08517BB354B834849948F2F2783B9EACA5BFEFDA0727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774698, "uuid": "2af7dfb6-0f29-41ec-b34a-e0c5c40e2e10", "value": "12288:uqMwj1bxsAY7Fm97RNtF5TP15tWoVx9eZcSBFpW059h8ETn13QMoz0XFUAqyvfE/:vXtPYZWNNTdLVnMZc+59uKgt+FymMDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774698, "uuid": "c091ba51-5b6e-4c23-8dd8-76aabca9bafe", "value": 873448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774698, "uuid": "9434668d-bd85-40ef-a792-8184360e3ea0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774698, "uuid": "45a5d0c2-6b16-4614-a161-a228159c1c82", "value": "Specification 01012_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95576c7b-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774811, "uuid": "b52a283a-b8af-4970-8508-bc5b0676e21d", "comment": "Malware payload (Formbook)", "value": "a370ee00eb4fcf3536d27755099d2f71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774811, "uuid": "f392cd6c-392b-4b2c-90b5-d36c171fd258", "comment": "Malware payload (Formbook)", "value": "8412907b0441a1695b45e1de5e7b446d28ab00f6da416bdb2575f51eb60e9647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774811, "uuid": "3383e821-2c9e-4df5-b49e-615b03559fae", "comment": "Malware payload (Formbook)", "value": "dd5b98d73dfbe47f9b2cff07b52cb616b09b9582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774811, "uuid": "e6369d8d-8b93-4bb3-a938-0f84b55e2cb9", "comment": "Malware payload (Formbook)", "value": "df66f1a8c1c06baba36251328fcbe7bd662101dd5151d70dd6c5a554cbb815d435ba199cbf39d49f55a292626a173545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774811, "uuid": "99490450-18e6-4e53-93af-238942695807", "value": "5A141283ABD09CB7F5AA433804B7597AA33E1104A12E5B574F904FEF2D31263891D77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774811, "uuid": "e800df79-c728-4539-b74d-90dc207cad97", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774811, "uuid": "41c38545-317e-4a8c-8162-a6bf1875bd14", "value": "3072:NeYBCwqDxkJ0jGyfZzst5URsm25VcgbPD27uOsZR0W4remCFFiULMzl5JqUVU+t:NDI1GS4Ks3bK7ucrezF0MMN2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774811, "uuid": "b7996af6-5804-438b-ac8b-481e15afcfc2", "value": 205734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774811, "uuid": "57722b8a-1bec-47a2-8b1e-0b9a05eae789", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774811, "uuid": "2cda75ea-33a3-4a3e-9bdb-edef1b49b5f5", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0328072-9777-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617782587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782587, "uuid": "2b4c4aa6-767f-4b85-a7e1-8baf0f1ea4bc", "comment": "Malware payload (AgentTesla)", "value": "8bf51148a51d4346c9a12d37b7fc3fcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782587, "uuid": "0cd93aa6-02c2-4911-b883-b78558df507c", "comment": "Malware payload (AgentTesla)", "value": "844b442fc19f704cfb140ba400248a68b1077989fc9a39e943789ed2dbde83d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782587, "uuid": "2f19dfd4-ca8c-4397-bd4c-ace262bda930", "comment": "Malware payload (AgentTesla)", "value": "c0e95a1923f3704eb7e865df89f37bfbb8e38c42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782587, "uuid": "7ca77ffb-7190-429f-8384-42401f2c656b", "comment": "Malware payload (AgentTesla)", "value": "da8f3c549d51121a38f68f2880477f133a088e9e1a685ccc1ba2bba585fc4b50f04e3bb64d87e99b8f145c7ce0b3e032", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782587, "uuid": "10db293a-52be-4dd2-bce1-2425c442d9c0", "value": "24053360945E40D36F10FBD14D5FA49A74F8E66364533EB23761397EA1ED222018FECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782587, "uuid": "7c7b35ca-f54e-4373-b6f8-525005c192e5", "value": "24576:yxFXThZevZackx98oa549JGfasg5ni7/tj:yDThqZackx982JGXJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617782587, "uuid": "2da5687d-39b9-4fa4-9065-1650fe170f24", "value": 839754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617782587, "uuid": "df128b99-6cf5-4baf-b9b6-bcc1af40e636", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782587, "uuid": "6ace3e9f-90f4-46e6-9ef3-f52dd7a18d54", "value": "IMG_00000000001.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65511952-977b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617784180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784180, "uuid": "21b3bcc5-4c69-4eb7-905f-ac18fcb25835", "comment": "Malware payload", "value": "9769e79320d5e9ed253a9b3932277ce3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784180, "uuid": "89c8ac93-49a6-477b-86c2-cae9356965e1", "comment": "Malware payload", "value": "85cf2cf2896ce8f8bb0bd546b1f4a82c86b2ee662c12044d3a4fc018b2d4bb09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784180, "uuid": "26764dc0-63ae-4f86-988b-b9c3229a24d7", "comment": "Malware payload", "value": "a7b78b5a61ef891a870cbda49648a072c9df2f48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784180, "uuid": "17808b63-510f-469b-8bff-84e5d7e8dcc5", "comment": "Malware payload", "value": "a2c2f45d05074eefd00c12127a01712dac79feaf34798fcad7c374b5558ee12d559795c7684f7a773c6c57753ab0fce7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784180, "uuid": "4490cab8-6432-4961-a30e-4cd4eb7d1f64", "value": "4453B4187698D219E0260F328ED6E7F63338BC546F8A433B3254332F6D776A19A25754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784180, "uuid": "14bb685c-98ae-4153-ab44-8844d07d0fd4", "value": "384:vGyO9SFPwEeUbwhFcHWQ0ymYMCbxuBclFo39D:vbP5MFcLMCbQcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617784180, "uuid": "a8597f1c-9063-41e6-87d1-2015904c80fc", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617784180, "uuid": "7a78cd8d-5b6d-4a04-a7e0-c8bd85b33e10", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784180, "uuid": "521451bf-af17-4679-94ac-c7a972013d1e", "value": "PO#070421APRIL-REV.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3daa6d-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811303, "uuid": "9f29e1af-167a-4806-91e0-d104bd06bbfb", "comment": "Malware payload (Sodinokibi)", "value": "ba0936a0060e90c5b3d0ec7f8aa0423d", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811303, "uuid": "c8795b8a-bc50-455e-900b-f0c608f58d93", "comment": "Malware payload (Sodinokibi)", "value": "86249470665edd52f64c2261389c00b001789cd83fcf412c36ef842ce434703e", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811303, "uuid": "ad57bc20-48bb-4bca-a63a-ffcbdebe7fcc", "comment": "Malware payload (Sodinokibi)", "value": "7c8012f4d71e45c62c0b92824b726c8aecf1bc90", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811303, "uuid": "7716d912-4d09-4a11-842d-74912f871247", "comment": "Malware payload (Sodinokibi)", "value": "de55e2c95b0c470e6960bfe4c596eb66a4dae3befa55a4b8f1364437da8ebe097921958337084da74352be6ed14ead00", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811303, "uuid": "25dc5a70-e7af-4d09-9128-43d3d43e24c9", "value": "D2C3BF22ADE142B2D59381FE133F3F275ABFBE318610585AE3204D4A4F69581F626727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811303, "uuid": "39ec8cd8-d369-4063-96ff-e786ad88e630", "value": "12b3d5a940cbcd57463181405f48f963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811303, "uuid": "3a5ffe0c-a88a-4ab4-a7dc-5d7a2bfcae56", "value": "1536:uRnNZyC8Pw7RZCq3L6xVh1uK0igtprD4pTqMPfLICS4A0qlfxWx7aSMPunJPfSaM:/zY7MjtIprD0RfwiqlfxG2SJnd6aHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811303, "uuid": "17c13892-d664-47de-94b3-898bd4022d58", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811303, "uuid": "71f0beff-da61-4a86-90cd-c833b36e6f8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811303, "uuid": "80b41dbf-45f2-448b-992e-07f4feb19ee6", "value": "86249470665edd52f64c2261389c00b001789cd83fcf412c36ef842ce434703e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3083686-97b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1617810187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810187, "uuid": "affd16b3-376e-43e7-ad71-b87b31a5a8b2", "comment": "Malware payload (Hancitor)", "value": "7175636163acfd9c9d63c17103a4bfcb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810187, "uuid": "960d26cf-c363-44d7-9c7e-02ca5a4ac923", "comment": "Malware payload (Hancitor)", "value": "8703be0c7c11a05e5f44902b3a82ecbbce8475799a867d11d1fc1920f5dec9e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810187, "uuid": "7129deb6-a6f0-4e58-b250-2714a3b750ac", "comment": "Malware payload (Hancitor)", "value": "bd31582aecbcd2c49454a71114e199d71295e5b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810187, "uuid": "c494face-9fb7-451e-aba9-d6a8c475f20d", "comment": "Malware payload (Hancitor)", "value": "f8b2bfb3fc64e73ce4e6de1a62c739e5e6f5ebeda3d3ea08cde4d8bae7e2663811b12bcbdbf124dcbc34a1cab73776d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810187, "uuid": "bc16aac5-e612-4180-b3bf-a9f6d99f6b84", "value": "87E48C2279C2C072D6B317320C7AD5B507FEB8704D708B9BA3A8163E5F7A9935624763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810187, "uuid": "a3c400e9-7a4f-48f8-9059-57b15d3e0a90", "value": "0728386a6438b6947ea648dd20eca127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810187, "uuid": "4274eed9-07f3-45a7-bed5-2b2f4c52c66d", "value": "12288:UjYr5N1IzpnhgdRpm6a1dpjGYyArCiloTS3D1EemgW9CcBARRYYNKSpAG:gs5YpnqdC6a1dpSoffW9DARQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617810187, "uuid": "a95b9042-2530-40bc-991a-2543808f5a88", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617810187, "uuid": "813ef576-34cb-4e62-a8ea-e955b573987e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810187, "uuid": "ae760dec-e157-40d2-9a78-c95ad3abfee1", "value": "msals.pumpl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92be9a35-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811314, "uuid": "7ec6047c-5107-443c-ab01-9f0fae77dd9a", "comment": "Malware payload (Sodinokibi)", "value": "52d280d45daba695a565e25cdd2863d8", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811314, "uuid": "d6b92bf0-a1c5-43bf-92d1-a3b2b9d6d28f", "comment": "Malware payload (Sodinokibi)", "value": "892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811314, "uuid": "089e246e-5f73-4930-8db2-52dc90ad79e4", "comment": "Malware payload (Sodinokibi)", "value": "60c525e2a52137514d3dfa72e8a49a0d4da98759", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811314, "uuid": "9133d428-7dce-48a6-b4ee-e3da7c5f0a2c", "comment": "Malware payload (Sodinokibi)", "value": "bf71f35f70a92ac2b93b778aedc12c6ea8c4eda44603ce95eb2c6ba3bf35128f00ac7c5d4e459a8f849e0186c06a9709", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811314, "uuid": "6d96fd8c-0543-4267-8adc-3835e44ac523", "value": "31C3C023B9E042B2E19784FE132F3F224DBFBE359614581AD3205C494F6A5D1E627B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811314, "uuid": "b832f96c-5d6e-4d57-8144-83af65b15ba4", "value": "12b3d5a940cbcd57463181405f48f963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811314, "uuid": "b4542832-6d07-4459-b6c9-f886382b63c8", "value": "1536:uRnNZyC8Pw7RZCq3L6xVh1uK0igtprD4pTqMPfLICS4A0qeCQ7sNl3eGVbgYozxG:/zY7MjtIprD0RfwiqXl3eGV8YCxoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811314, "uuid": "3ed52318-44f1-4be8-8047-fa140f2aa6b8", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811314, "uuid": "e2220280-c599-47e4-b056-0c2badec9381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811314, "uuid": "79b0e196-6ce9-49f8-ac26-52b249ad8934", "value": "892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141a9498-97b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617808525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808525, "uuid": "5fc5a672-c5a7-425a-b986-4a08c9f7cc2e", "comment": "Malware payload (njrat)", "value": "c8f3d246f0b9426f0193329a47365e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808525, "uuid": "1daaf8cc-7e84-4434-b3be-36c176b3eb9c", "comment": "Malware payload (njrat)", "value": "8aaa07e878214217cee0e8f3a835b89eb50c38ede769c958f3d6c7d72d9fb363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808525, "uuid": "a81a81d3-2218-4698-a980-fab2167d0206", "comment": "Malware payload (njrat)", "value": "e8c7e076a2a64b9f8ef40b8ffde953b49536f93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617808525, "uuid": "b33a6717-6e43-420f-af23-9bca78378f42", "comment": "Malware payload (njrat)", "value": "500cfa0aaa5240cd061d3c5a7fdf6dfd2e85b8ff72bca8afded8da45ba1d8f6237c2733ceccf00241c463dfdc6c89400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808525, "uuid": "9f2c9169-0a27-41f6-b75f-bee982caaf5a", "value": "31B22A0E3FA98866C57C1B74C6A5565003B491470423EE2FCDC554CBAFB3ADA2D8CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808525, "uuid": "55e0105e-6a5a-4aa4-8d87-d2030ddfbebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808525, "uuid": "ee836c1c-fe95-412a-92ee-d41c24cf2ac0", "value": "384:oQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZ3fxy:TLL6MVU0NRpcnuEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617808525, "uuid": "e16a91fb-b91b-4b84-8c77-460c68257042", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617808525, "uuid": "a6eef5fe-1b9f-4e1d-8487-ef624061cc36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617808525, "uuid": "67a952b3-cd96-48e8-8b53-1b24e65a7dff", "value": "C8F3D246F0B9426F0193329A47365E30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab47a93-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617774713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774713, "uuid": "0cedcbb2-ad62-41c7-8d02-07357922454b", "comment": "Malware payload (RemcosRAT)", "value": "4f7a6b9d0bdad97a2386e8eb231bc77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774713, "uuid": "07cd0e1a-ed9c-428b-abd8-fa5a9ee45902", "comment": "Malware payload (RemcosRAT)", "value": "8acdca153a4e16a5ff668a0a5ad8c274d2307a88cda385575ee4fbb8374d2254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774713, "uuid": "66b1cab6-470f-48e8-860c-0401926bcddf", "comment": "Malware payload (RemcosRAT)", "value": "641ef1f759b5690aef33e2a758419212eac5abd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774713, "uuid": "50811a25-fcfc-4e55-9e94-798f8ba58cb9", "comment": "Malware payload (RemcosRAT)", "value": "851aa344fae257e84db6a48f9a90968205b2cf1537f41e2e36236fd1f15f269a06df20a05c51b09c3c0f26f00a97255d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774713, "uuid": "62dbbb21-697a-4250-9d34-959b7ec5deaf", "value": "68D48E21E3E28437D1BF2B7E9C6BB6A04C31FA9229F534492BF458484F757813829797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774713, "uuid": "7cbc60c7-b02c-4676-b580-0ba770e4d701", "value": "810b60d80fc0f9a70fe609b43363aa3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774713, "uuid": "10f7ded8-7d4d-406e-b81a-f439b10f3bd6", "value": "12288:9mZutCqMrtdeLlyKvPpfKnbOEV7S8wt+ZfU/OyV:9+ugtdeL5JoTVuDtCfUDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774713, "uuid": "0774ce0c-fe73-42e1-9bb4-96b22bbfbe54", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774713, "uuid": "1f679afa-c16f-495b-834a-e41139c914dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774713, "uuid": "0b5dd9f8-9627-4352-a42e-8cc1b25a219e", "value": "INVOICE_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e853d5c-97b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617810233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810233, "uuid": "7dafec46-5728-44a2-aac7-10df23fd1742", "comment": "Malware payload (AveMariaRAT)", "value": "8f28453a1e07da3f8e04aa4fdf0f7495", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810233, "uuid": "13b0a015-d276-426e-a51d-9c031c880e22", "comment": "Malware payload (AveMariaRAT)", "value": "8ad1ee75b0e6ad7140aed361cc0000ff540f01fc4e63591a64ccbeedc31dcaa8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810233, "uuid": "c65b1577-9cbd-459e-b1ec-39cdd4e9d405", "comment": "Malware payload (AveMariaRAT)", "value": "ef2d3361edba3da14a33795a27872ccb0c91f54a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810233, "uuid": "13ad722f-3efb-4806-8771-998d6912bd99", "comment": "Malware payload (AveMariaRAT)", "value": "e01709d54c5ce8af978ba3fd024dbbdc5e548066988314ca0474d03784e11b2e814e0300b1054aa94a07b1b5960a2137", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810233, "uuid": "c90eecc9-ecfb-46d5-a0a2-d283eb2dbcea", "value": "7305E07023A85B59E2BE97BA0060A15017F7B14AE732D70C3CB8519E5D72B81DB33B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810233, "uuid": "3a5fe64e-ea48-49f3-b823-010c279d0109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810233, "uuid": "f0aa5c78-9683-4aa2-9398-c47b9d63c872", "value": "24576:ToHcBYPym0UWHxysNRW/fosoI5wIpbikyqFU:To8BYK1UWHxnW/gI51pByq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617810233, "uuid": "5f4e2cfd-48e8-45c7-a236-7043bb8b5225", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617810233, "uuid": "c209640e-887e-43c8-aafe-2c0a2924906a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810233, "uuid": "bda238a1-c78b-4ad3-9127-c210b1c438ff", "value": "PO.20210704_quick shipment.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ff2d2a-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617794361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794361, "uuid": "c0722656-89ba-4460-b46e-f2632500d8ab", "comment": "Malware payload (AveMariaRAT)", "value": "9516772cea9f00a47b850045f1482538", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794361, "uuid": "d7ce7b54-b580-4f6d-904d-4c10ea5e50fb", "comment": "Malware payload (AveMariaRAT)", "value": "8af58513413e600f76bcbbad8c683a23e714337acf9302212ee82c6f0e8c0519", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794361, "uuid": "a7e641e3-5a19-4120-84a2-e6ad401d22fb", "comment": "Malware payload (AveMariaRAT)", "value": "30b9458aea715f7000113893ba282bdad4f832ba", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794361, "uuid": "5a19da2d-1325-4e40-b9b8-9204755fa018", "comment": "Malware payload (AveMariaRAT)", "value": "74d310f847d1a54c51f5e04f1261acb56c899428111dd873a34cb88a6b3c4f70e7730fc1071a5fc11b8d7d0eb52b29df", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794361, "uuid": "96c77ea6-88c0-4ae9-bd0b-22ded45c909d", "value": "CBD49E22F6E21033E0633B7D9C2FB368583ABA4129F554CA2BD51C485F79681792F397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794361, "uuid": "a15a43a3-5baf-45e1-bf70-ff203e83fd6b", "value": "af52f63bf30089caa8a0bd17b5f786c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794361, "uuid": "27516370-7fa1-41df-a9dd-0ec3ff04d1cb", "value": "12288:23e7vWhDoA/ytg+9qfAsVfbv3APAU/OyVc:2O7HA/jfzb4YUDVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794361, "uuid": "f870af2f-2e29-49c6-8649-9c130ca8fe42", "value": 652432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794361, "uuid": "c190b2a4-78f9-40f6-ab27-19b165f16538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794361, "uuid": "f8774924-1058-48bf-ab6c-9fe0823992fa", "value": "9mm case for ROYAL METAL INDUSTRIES 3milmonth Specification drawings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc96f3c-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617772782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772782, "uuid": "f253c96e-f97b-443a-ab21-7d1b30b0df2f", "comment": "Malware payload (AgentTesla)", "value": "a8719cafb919bb69ea5928611d748c8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772782, "uuid": "a8a129ce-1e06-448c-99ea-6781baa144b5", "comment": "Malware payload (AgentTesla)", "value": "8b0b16714efce9bf5433abf0aa20790d662b5c456f56e518075d78084763d94e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772782, "uuid": "04786e3c-28cb-441b-a0e7-0f7efe953bd4", "comment": "Malware payload (AgentTesla)", "value": "d30d8a2466783227237bd64e63611f90c023e414", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772782, "uuid": "5247d216-3220-4036-92fd-4df4220f3ea5", "comment": "Malware payload (AgentTesla)", "value": "1b9ae540a891377015fd18b48280fe76aa68ddfe97122a400795e46e07e182cbdccd43e879323fe5f569d8eb8cd7e89a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772782, "uuid": "b6d2f973-77dd-4d6c-8bf7-a9151844d081", "value": "08F433132BD794A4662FDFA3C524146521BC5FB2C0EE1556D9C3CEAB336A41FF62808B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772782, "uuid": "2fca9bac-b82c-409d-88d3-1b2908e39b95", "value": "12288:KQR/emJoIgcZlacTlAe28IQztTP6AeR6a3Vcl82qIhxWDgx/RS5Y5ADsv:3cmJb3favX8IQz961r3e82qI6DgZReYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772782, "uuid": "3a0567e6-3cb5-4a6f-bdd7-aaefac649999", "value": 750464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772782, "uuid": "bf147111-2d01-408c-b543-b24c031f403a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772782, "uuid": "e0cce742-89a8-4c5f-872c-aa6a2a949f59", "value": "SG1_000000123205044_1.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae48ecd3-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617768411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768411, "uuid": "24537151-4545-4f8b-817e-edcbfff340ce", "comment": "Malware payload", "value": "22d89b51312dea42e58d2efb98673642", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768411, "uuid": "619adc93-b2a5-4f27-8fb3-3a4fc0837c4c", "comment": "Malware payload", "value": "8cb9b39e6beb0197d031508e11cb37ef534ff742c2fe7308f523a185e1ba7150", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768411, "uuid": "a6dad35d-33c7-4c4f-93e2-30948791b3b5", "comment": "Malware payload", "value": "11c9504317cb2ce8288f252290c760e4a75d699c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768411, "uuid": "dcb226fe-b1d7-4992-a980-d51e989df9c7", "comment": "Malware payload", "value": "37da279016bdd67ae2b5f9dcad15f53817fdf609e09dd65fb0cc13e835f295f6175d175e9711860ac370ab04e075d6f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768411, "uuid": "e71a24b6-5da5-40c8-90e7-76f01ea0444a", "value": "455533FB6F0D00DB3471E85490539A3F6572C01B2A49FFE701967B2EDE741F905AAA88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768411, "uuid": "93854ff7-567d-45ba-916c-ef2efaacfe3e", "value": "24576:BTEp701pkZ3Ifkgt5DqFZ3YWtjPqme/cZVwZCQMgrhi8vlMXs/p3P1a+JV9l81/Z:BTERopuMkgfqFqQwcZVwZB/jCCNPwSNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768411, "uuid": "f06c1a23-d271-499e-b02a-bd7d247e01fb", "value": 1340528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768411, "uuid": "6d4c1c00-7f03-4993-901b-0aa48f8d96ea", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768411, "uuid": "46bd71be-4dcb-4aec-abe2-3c153f00ee0d", "value": "AWB-18267638920511_ES.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54a09d3-97d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823881, "uuid": "a68dc258-adf6-4cbf-9e20-7009fb9d435d", "comment": "Malware payload (Dridex)", "value": "31963841fc754dbbccb625805661cf0d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823881, "uuid": "fe6f0a52-e9e3-468b-a233-bacf57ec2808", "comment": "Malware payload (Dridex)", "value": "8cec570664285ddbaa7ae4415ec81ae9e006ae36c979e954134033ef2a7baa8d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823881, "uuid": "80ef5674-8d49-4cbc-b81d-5723dd5a2c02", "comment": "Malware payload (Dridex)", "value": "8848f33a9f69f27392a836f00eeb2ca31801c5d1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823881, "uuid": "2a249608-0577-4f25-a79a-9c8f12847fe8", "comment": "Malware payload (Dridex)", "value": "aac0cee7d05029db22dd34dca71f2c65eb202138f70e3be9e2901158afd4cd8ff940da92e34215beda93da4c4af3ccc4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823881, "uuid": "94f6ff0e-6e7a-44ea-8fce-2b34117ee844", "value": "4B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823881, "uuid": "a5ffc767-d5f6-44e6-9017-e52a84687211", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823881, "uuid": "65a32033-1e39-4b80-90d9-9a328b8aee33", "value": "3072:50DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:MpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823881, "uuid": "ac91c895-47fc-47f3-97ea-5b85c1fb6053", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823881, "uuid": "180ca952-61c2-4ea6-b8b9-c910f62c1af2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823881, "uuid": "81f4e2db-66f6-4c27-a735-6b2e8a4538a8", "value": "8cec570664285ddbaa7ae4415ec81ae9e006ae36c979e954134033ef2a7baa8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2c9d14-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617775256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775256, "uuid": "94a0d905-0324-43ba-bcc4-225b77a67197", "comment": "Malware payload (AZORult)", "value": "9280faf9739c71e277d436a39f8a78af", "object_relation": "md5", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775256, "uuid": "40f1a4b4-7877-4307-a4e9-04159cfd8642", "comment": "Malware payload (AZORult)", "value": "8d0ec6dd1b038757b5b94ea9e3b9638a1b14d4305f6ace750f5b01df5a25d7a1", "object_relation": "sha256", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775256, "uuid": "453c467e-10b9-4261-a485-1f6d8c4f5b47", "comment": "Malware payload (AZORult)", "value": "d931602516e31c8828abee68c0d2f4072b093dbb", "object_relation": "sha1", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775256, "uuid": "b99d6d86-2036-4947-880a-503231a73820", "comment": "Malware payload (AZORult)", "value": "3d42de99e683ccbae982c6ae846f4ac0fc906950e3f280b08ff192c22deea0f46582726d0d275cacc0b875bce383b811", "object_relation": "sha3-384", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775256, "uuid": "009658d6-bdeb-4c9a-83d6-edad7a6a3583", "value": "BA42BF046C0F471EA05A0AD93E654DC36FBB2C312243EE1DF59BFD6A9778B92F815084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775256, "uuid": "3ec647a5-3c70-4b56-afb4-6fba074fd3da", "value": "192:8ukw5nHiYnqCCufsQ6s7GLfJBViyyW0ih1/RusPuEUMVRC03ZzKQwxZsym61FfkX:814HZGufbqDXVi80y1PPHUMTC0FKQwxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775256, "uuid": "139dc8f8-4a03-40ee-9b43-d28990f466b6", "value": 12187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775256, "uuid": "9fac0254-74ce-4b45-94d3-2a0113d3c61c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775256, "uuid": "4eb04c33-8af6-4ab3-a75b-9fec4f03875e", "value": "PO 652872-90.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37449b14-9754-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617767352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767352, "uuid": "db1206b9-46aa-45a5-8baa-b65bd33c68b3", "comment": "Malware payload (SilentBuilder)", "value": "a7c64329efaea29a2dc97ced238490f7", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767352, "uuid": "ea2aaa33-b82e-4105-94a7-f13f8be3abb1", "comment": "Malware payload (SilentBuilder)", "value": "8ee305eec94aaef24116983ceef933359fb860ab50787b7963c3f46fe751630c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767352, "uuid": "4cebf2ad-5ce2-4d2c-aacb-c3cc1288502c", "comment": "Malware payload (SilentBuilder)", "value": "5d4b9b386354444cf74fd858e3409f0294c45330", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617767352, "uuid": "97eb0479-2799-4a70-9ce7-68eab18aa93c", "comment": "Malware payload (SilentBuilder)", "value": "2d739ab17d12b8da78500af6ebcb38a5262d17fb59590d2e0a4db64d3d4b24025e9494d88971c4a3ed20d0dd8aa25da6", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767352, "uuid": "73f0fc2c-8dc8-45d8-b1f4-b456aec345a7", "value": "5144E6D2B2029128E0541F3AE572067C82E6FFAA7B18F49B6C05B3B77B771D13E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767352, "uuid": "b2c7fdde-9406-4cce-ad92-2e0df44a9721", "value": "6144:JcPiTQAVW/89BQnmlcGvgZ7rDjo8UOMIJK+xTh0+:Fh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617767352, "uuid": "aa51ebc6-ce21-4316-b4be-088ad1589aee", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617767352, "uuid": "8ca7f848-cfd5-4f83-afd0-12ac41466121", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617767352, "uuid": "95c26af9-5d49-428f-b497-df58175d225a", "value": "SecuriteInfo.com.Trojan.Agent.FFFK.8079.3665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9affd2d-9795-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617795595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795595, "uuid": "5eb42ce8-fa01-4ae5-ad92-9a82e1064e67", "comment": "Malware payload", "value": "895f14aad25d6d5b39d8e9b7704a0e60", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795595, "uuid": "a41cebd9-d114-4a44-b477-d6db0e6de46d", "comment": "Malware payload", "value": "8f52c0b9c2241adc2e0a75b0f35716d2bfcb50fe1d35f7c083c4da1b5cf904fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795595, "uuid": "b96a0125-d92a-4fa9-b809-872b32d07def", "comment": "Malware payload", "value": "48806ae3d923c03a1f0b07553c66631822c526be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795595, "uuid": "12ec990f-853a-47ad-b599-8b75b964e97e", "comment": "Malware payload", "value": "e4f0268b6813947d9215e91e72ee41adad5a29035e85da1070cf1f4151757146dcab2d6f9c8d6517ff11df4fb80247a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795595, "uuid": "edf022e2-b2af-4f41-b109-d665d22c1ff4", "value": "70E2E0804F0F22DCF9A8090B65FEAB26980256FB929BF0ECC5E554D39111314F2F973A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795595, "uuid": "55f4d337-e9e8-46dd-b672-b40d207682b1", "value": "768:25wdc60usmOmuZ/zPX9e04LAUke9y1rJzwrkghX0EUWWv45:Tb0ZV/cFAJz+kggv45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617795595, "uuid": "226af59f-2c58-4e5c-8f3b-0f11cabead3c", "value": 33389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617795595, "uuid": "a14f0e94-e652-4949-a340-acf590a4fe39", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795595, "uuid": "e5d26b10-4876-4b27-85d3-3115cc61b391", "value": "2230_0001677 FACTURA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8e2ad9-9758-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617769079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617769079, "uuid": "f8487b39-2685-4b25-b54d-b3591cba41cb", "comment": "Malware payload (AgentTesla)", "value": "6c4de63c98cd02fac6c8950b33931242", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617769079, "uuid": "c48551a8-b250-44da-97b1-8a85f929395f", "comment": "Malware payload (AgentTesla)", "value": "8f55f8de19bd0970f71368ea4485c8959dbd02c19ac14e9fc444ae5545ec9951", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617769079, "uuid": "effd337a-baf2-48f8-b585-3cc70466991b", "comment": "Malware payload (AgentTesla)", "value": "9e50f47811259d77a95d1d205660dbd753a704b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617769079, "uuid": "9327494f-73ee-41c6-ad78-6ed997a438b8", "comment": "Malware payload (AgentTesla)", "value": "61f592009c74a4c527c0a968847899e5ddab7cbc702701ccc9c4c628219a2e340743993230d6bcb47ba628802c9a4d8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617769079, "uuid": "6fb16aac-c586-4711-84d2-66a062ba31bb", "value": "95E4338CD28EC9AA8F05F5A54D8B4F83866F5A2FE84E203729054B9DCD8F7680D07756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617769079, "uuid": "fa0b4815-c03f-4f3b-94a0-c7340820fb71", "value": "12288:X4tal1X9eHWdDeYIuLPHqDg1RikxegTD8cUjtndF/Iyc+1QW4y8t:ItW1NNCNoqE18KRDB+tndO+94dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617769079, "uuid": "c99fde30-337b-4af4-805d-0c8d1c793bb1", "value": 676668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617769079, "uuid": "ee8e124b-2133-4463-a81a-25a969b9f666", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617769079, "uuid": "e18d0854-d464-4a79-aa44-11e20384b9db", "value": "Consignment Document.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb97015-978b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617790906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790906, "uuid": "32027a2b-c8a2-4238-a5b7-2c0c24628408", "comment": "Malware payload", "value": "415e160a516aefc64b7e25ac81c14768", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790906, "uuid": "4b939e26-7746-4afe-a6a6-4b9d0f4129e1", "comment": "Malware payload", "value": "8f9a0b7230034eeb043874da6566de2a31a481a1a3391282d6f81ec58a1015ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790906, "uuid": "06df231f-4b34-4293-8228-eba18d385c56", "comment": "Malware payload", "value": "5d707e61e17112698c19ca2d296964d266b34fa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790906, "uuid": "ab9a5802-0e88-4350-b114-8cadb9396da5", "comment": "Malware payload", "value": "384bd2c4814cd9b77f0de17a64a438de2301a3fd6c8562f5f9953e13f343872efc4dd8cb09c0fdbb538a1b265374038b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790906, "uuid": "e0b5c075-c3e3-44fb-aea8-8ee711c1b41c", "value": "D3D3132D5CE37E34EDB5BA3160E66C3F05418A1CA9BD9112E60E55CB85CFA63B20A0E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790906, "uuid": "7f79084e-0097-42e9-b742-50ab8ebcd73a", "value": "3072:3prUV/o6Trg2+tvYSka/NcMKgQXyVivuRvSU9DfANk:5ASsrg2+pYSrcMKGIuRvSU9kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617790906, "uuid": "2bbfc7fb-11f3-412d-be24-d56f065f14ab", "value": 142621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617790906, "uuid": "7a3ca159-0f0a-48bc-8edd-856040351e18", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790906, "uuid": "8bc9c548-806e-4a03-b9b0-2557551f99d6", "value": "Ordine_no-1110033351.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbaef81-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617772463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772463, "uuid": "089f093f-a564-4b10-ab51-c41ce4c0f1fe", "comment": "Malware payload (AgentTesla)", "value": "e5ac41a9c6bb08961ec44ad4b201e2a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772463, "uuid": "3c704030-717c-4fbd-8678-4b1708f25230", "comment": "Malware payload (AgentTesla)", "value": "908b44db519efa5b664ade3863effe7d10d0e71498a57c24cb898e295cdaa49e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772463, "uuid": "b005e656-e278-4e3a-9120-075392ee898c", "comment": "Malware payload (AgentTesla)", "value": "9e9dfa0f6617614788e963ef042fb3758c5f4e99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772463, "uuid": "b1582885-01df-4424-a68b-a5bd899f3670", "comment": "Malware payload (AgentTesla)", "value": "920a8e5acbed8edc4bf748a530936b999c5de4acfb0d060e8f2a8b785a8ed2eca661aacb5d02940be5c9c41bd3746fc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772463, "uuid": "636d55e4-408e-4f33-9743-4cdf60f65d62", "value": "D3B423C4C34112D472EB5ED2B4F78184746E649C4B0FBB9A7806E796F0F4470A69EEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772463, "uuid": "c324dc7f-28a7-4c1e-8eb6-6bbaee14b1dc", "value": "12288:0w0+S6TsJPk4fVNOlOyj/UFVOFS9nn/NM5WtvPkFZ:0h+SHJPk4fVNOl1mYqnFM5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772463, "uuid": "069d09d4-0ef5-4a98-a65f-25fced9d780e", "value": 528658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772463, "uuid": "d78b8884-ea49-4328-bf7b-f05f330340cd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772463, "uuid": "be73bf57-4317-409e-a20d-b75b826b0213", "value": "Documentos de DHL..PDF.....gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f410782a-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774970, "uuid": "6a76a6cb-4374-4d86-8708-3f6d061155ce", "comment": "Malware payload (Formbook)", "value": "3a3c31db80f66c72d3d2b955b36d8362", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774970, "uuid": "a8e3a625-4f3e-4c64-9ab2-85e530917db5", "comment": "Malware payload (Formbook)", "value": "90d344562158255d4b094a2e157cd1196b4248bf01584d6c10f1ae33caf9ac70", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774970, "uuid": "a28a0344-c750-49f9-a77d-6599fdf4bb45", "comment": "Malware payload (Formbook)", "value": "fc5afb4ae528f2c0b2b93fdb35f1a1c8fad5f60e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774970, "uuid": "056cb67b-3fc5-436f-81ca-78a3f69a9716", "comment": "Malware payload (Formbook)", "value": "770095270f92431e04ef60f0d647b5072f3a9ab61b0075f0bb336f7ab3b060ef3e8b1d141282b23ad4429afc0b66bde7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774970, "uuid": "106953b0-11f8-4ad7-965d-3c96ab8b9517", "value": "1762D0ED2D91E6A5E0797E60BD099FB858303498E1A61C68F379B0DF28E1321C50F81B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774970, "uuid": "967664ef-d0fc-410c-95f4-aa353fcdcaef", "value": "384:iYgQViV2HfFVdhoL1eDtYC/W0SqtBeQx04BoeHD8GnL6C:xJiV2/hho1XIjO4BoS8YeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774970, "uuid": "2ee02719-ea65-49ec-b8e9-6adeaeac68d2", "value": 15382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774970, "uuid": "847bdfd9-ac75-4cfa-a860-eb762d693611", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774970, "uuid": "a57ef646-72db-4e71-afe6-f9da6ac3c52a", "value": "BL8846545545363.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6502c-978a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617790824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790824, "uuid": "36126347-b90d-4036-ab5b-b240f98351f9", "comment": "Malware payload (SnakeKeylogger)", "value": "3be9c16df360ee43d02ca30b983ef511", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790824, "uuid": "ea9d6f9b-3c28-4937-8adc-b690a1cc9110", "comment": "Malware payload (SnakeKeylogger)", "value": "91dd06629dc59bd27bf10b253e4c7b5b12b0bf2809eb39fcc4faf18540cc8b19", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790824, "uuid": "0f2beecf-0ac9-4c25-88d4-333e944d0d4a", "comment": "Malware payload (SnakeKeylogger)", "value": "19c2b600b630bbb0202ac4389f568ca2e14bb2c7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617790824, "uuid": "40ed1c15-165a-4ecf-a6fc-63c53ffaecbf", "comment": "Malware payload (SnakeKeylogger)", "value": "21db77906cb10f2d712528c099836ac4ac85f04f73f20e3f1e4bee3ef4e8af680913be26a64d0291385c84e19bc84853", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790824, "uuid": "4b946790-4ba1-4641-a446-3be12af35c4d", "value": "9625AD3822F4AB51D439023223E1D0245AF1AF6CDEE5D30AFDB829C5B752DD82E9561F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790824, "uuid": "9050e8ff-7885-4abc-934d-71c770ac2667", "value": "24576:9PtmaCJaLNYfhBGZ5IgOl+2LwhhFZRvDuW3Ad:9PtmQLKJBG3o+2LwBZ0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617790824, "uuid": "2fcbaf26-2be9-4db2-a6dd-c1db3f70444c", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617790824, "uuid": "aa880345-9bd1-4eee-81eb-8976bf2317cb", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617790824, "uuid": "379e81c1-ebe4-484c-9923-ac58ffa9cd44", "value": "Dringende RFQ_AP75887658_98788,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7d8d82-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775251, "uuid": "0af1768b-5a0b-4c02-be38-553962cb6566", "comment": "Malware payload (AgentTesla)", "value": "6ba769ce8e66f1da197ff0806c237a18", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775251, "uuid": "2399eba1-b7e3-4b2e-afec-3a8325d5c254", "comment": "Malware payload (AgentTesla)", "value": "91f2977a78b83c82eab6e06c9cda64ce13f40461711fcafffb2853189470894c", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775251, "uuid": "a79bc492-cabc-4c67-8cb7-c20bfe1a8872", "comment": "Malware payload (AgentTesla)", "value": "81ab9620e9b668d113bfaa1d4e20c18e728109eb", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775251, "uuid": "557026cc-e317-467e-a99a-2f571d5b29d9", "comment": "Malware payload (AgentTesla)", "value": "e47b63d9f39aeb5cd48dae2f7156c32fadcf56589b7a59b6d5f65eae78f2db1062f93e280b933bdcaa5e56e4f4605756", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775251, "uuid": "b7d3af1a-5c0d-4c43-8a4a-420e81dcfece", "value": "0CD423D08C997B504BF9C5C9C9F195006BA7B5B9270BB2DD41C932C740E764CBB82B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775251, "uuid": "60b7a289-3384-4699-96ad-6a1a303a0e17", "value": "6144:MCGFoGWgxcONxNvqYLdH+K2Mr2eb7IO6t0BKOOf61aZbX56e3UR2rmOhjzi8N7FE:V3gG+xNamr2eVJvOiYFseIEtn0nXHcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775251, "uuid": "d5e6bfb4-58f8-47a1-bfcf-9da415de2e2d", "value": 638751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775251, "uuid": "341d7bd6-4bed-4204-bd65-e8100f21f98c", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775251, "uuid": "2a14b651-e0ba-4406-a5fa-c5b67b24f60b", "value": "SHIPPING DOCS - MV. SN QUEEN.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805a59fe-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617774776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774776, "uuid": "80afcc5b-9e07-467c-9cee-cbcb2fc94437", "comment": "Malware payload (SnakeKeylogger)", "value": "02af62d99e4813a452be33a859fc9e8d", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774776, "uuid": "f69c131d-2f61-4ef1-a3b5-5685a9d49522", "comment": "Malware payload (SnakeKeylogger)", "value": "9221fe9d8b10dded0ffe2545b8e249b3110834324ae3fff763066f944454473b", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774776, "uuid": "47964709-20e4-4ca6-b88c-268a18e6dacf", "comment": "Malware payload (SnakeKeylogger)", "value": "483dda6ad27461ccc0f1d07b6dee84e88b0fbc73", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774776, "uuid": "3f7f8f84-c9ea-473a-8449-02b414100a9e", "comment": "Malware payload (SnakeKeylogger)", "value": "541e5d62595e21d89196ee14955afa3f2de922a97c556a94b3868a23785dfee9e7a009b946f3676df8de155530b3d5d5", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774776, "uuid": "877c83e1-d78b-4638-9a3e-0ef4ad6b78f7", "value": "EBC423A26FD68D87F630558F42181F6490E3DF41806EEE3BBC1659FA01F5EB80689BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774776, "uuid": "38ce230f-d2bc-4240-8fdb-55a641901f3d", "value": "12288:3FO2+ISRmj3rsXE/KRX5tcCQeOzNfkqUZm1l6o:3FJXvWht5uSAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774776, "uuid": "4ecc558e-3acb-4892-9d51-83dcc0d4ad34", "value": 546742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774776, "uuid": "a0b5d1ad-f744-4c66-afd3-aaa322ce7bfd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774776, "uuid": "fe6d721a-fe45-41e8-95d1-a30db1b016b1", "value": "doc20192910887888001990.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1905bdd6-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617794360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794360, "uuid": "fd5521ea-e362-482d-a8b1-aef1f07b3091", "comment": "Malware payload (AveMariaRAT)", "value": "54e6961afe4a51cdf6263c30b035ed98", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794360, "uuid": "342a2530-adf9-41f1-b933-3cb5c6cc3cbc", "comment": "Malware payload (AveMariaRAT)", "value": "92ce331b9886f81e106848ecd4c50ef7e647372a1c16d539fa123612d111b92f", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794360, "uuid": "6c509820-e035-45a6-b8dd-1e4d8cb61f50", "comment": "Malware payload (AveMariaRAT)", "value": "9c8aa6196fd68f93fb38a30dd038c15181aafab2", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794360, "uuid": "fa300cb0-2197-4014-bf8a-952e84e17b96", "comment": "Malware payload (AveMariaRAT)", "value": "b74d7d559c6ee1e444852ab5eb5da2b5434b037f82e6d36669abcdc62a6c9d459a16b46b16ed9019c4136dc116319b44", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794360, "uuid": "536f2ad0-7a3c-4e21-bcbe-6ee0e6f5ec44", "value": "6D542300BB0A8157619825F46DCB0419665FDD89EF11E3ECF66012DB663AAB90BF20DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794360, "uuid": "4968bd45-288a-4dd0-b1bb-db6f1864d265", "value": "6144:m5Wsc7P5t4fT7EjypcmJ3zWaVEIFq9aKSn9jbAMFsJ/:m5WDLAT760RNVKSn9oYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794360, "uuid": "5e110ae1-a85e-4002-993d-9d38ba0ee879", "value": 284320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794360, "uuid": "acb08717-005b-4aec-af07-d2c915db9159", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794360, "uuid": "91ebecf3-a2f9-4a60-aa0b-2b3362ad7cc1", "value": "9mm case for ROYAL METAL INDUSTRIES 3milmonth Specification drawings.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ce4a67-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811323, "uuid": "a3a2dda7-6c8b-4c8c-8229-c4fba2f47bf5", "comment": "Malware payload (Sodinokibi)", "value": "8265a35b73b1de8ecb204202e44cbc4d", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811323, "uuid": "ff449615-77c9-4c7f-99de-1cdf017f039a", "comment": "Malware payload (Sodinokibi)", "value": "93c4b144a4ef5e9ebcb5de425f6151fb6fd892d1042b21e639ab6c358cad3940", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811323, "uuid": "4fcb7034-786e-4f40-af68-d36a6d4f2189", "comment": "Malware payload (Sodinokibi)", "value": "cbd2632ede0831883a1c7ba1ab7977be13ca4dd3", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811323, "uuid": "07ca316e-6eea-4150-ab19-b4be04ca77c5", "comment": "Malware payload (Sodinokibi)", "value": "86a6fa64d5407c3471e6cdff78666983c6f681c04c4d54453d58bb411d0f6c35a01943341368f460fb11306f08f14f29", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811323, "uuid": "5bafb2ed-2be0-4e01-898c-8b4503c16bd1", "value": "B3C3D023BD9042B3D59380F7132F3F13D9BDFE72151528ABE36149841EAA4D2E626717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811323, "uuid": "9a3b5a67-2909-4ee3-9d4f-b1ad6c098bc2", "value": "b321b6896e18906d7c1d33f3e88fe16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811323, "uuid": "0dcf77d0-89cf-4b72-8fce-cf986115129b", "value": "1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUI4ojyo1jLnv1b:mmV1wKdLoLC/OemULo91jLnv1O3LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811323, "uuid": "662178d3-ef34-4ff4-b331-db8b1ec8a635", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811323, "uuid": "d66b3235-4fac-4f20-9a9f-1d5d9220779a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811323, "uuid": "b598058e-2e89-4f3c-a13f-34910380b90f", "value": "93c4b144a4ef5e9ebcb5de425f6151fb6fd892d1042b21e639ab6c358cad3940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8730c175-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774788, "uuid": "178644ad-8e05-4f5c-93e2-88ae37af33c3", "comment": "Malware payload (Formbook)", "value": "650b9d8e867e08c9135e3c5d93612f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774788, "uuid": "226f5d37-70b5-44fd-94e9-974e824e5ab8", "comment": "Malware payload (Formbook)", "value": "94235ec4fec92239bf53cbe18e6b698f30ca30d07602cc123dcf76d728bff41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774788, "uuid": "94529b83-4b58-492d-aad4-3e76691ea4ab", "comment": "Malware payload (Formbook)", "value": "e3f6712f4b177aaeafad68dfafee1235e34642a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774788, "uuid": "fb89420a-63a9-445f-a663-0e9620c59b3a", "comment": "Malware payload (Formbook)", "value": "3b8cf4d1042f75b924dd05e2724250f983f2ca7f314621a42351bf3d010b52299ad45a9807952908ace318deaac470db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774788, "uuid": "13fb7955-c194-4c98-9b55-bd3294184f95", "value": "86B4E11E3B917A95D74C8FB3496B18D812F1821B702AF73F68C91BC8CE1675E132A527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774788, "uuid": "ce32a559-747b-4caa-87fe-d3adc0384aba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774788, "uuid": "61a9c809-130f-4f01-9876-de63b3ea0c36", "value": "12288:xXKpIV1Fn6OAVo1TyoJSq5Qbxn09z2OjI:B65o1DC909P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774788, "uuid": "26065556-eec5-4e4e-9355-5373ba4e2ee4", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774788, "uuid": "303b5577-9445-42bf-ae77-543e7968d72b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774788, "uuid": "e51ac824-d2da-44f4-93c8-1a9fca6f4d9b", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27d95ad-97f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617835500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835500, "uuid": "914c9a90-83f4-4e85-a6cb-7e0538cb8ba7", "comment": "Malware payload", "value": "846ef134f45ac1a3a588c02cdf6c3ec2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835500, "uuid": "5882c33a-5c10-44a4-9207-830aee49aa72", "comment": "Malware payload", "value": "978d1d6690e83f0508a551f8b469159f3d6ac908e081a33f6c9b632e8ab5e433", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835500, "uuid": "b4c5099d-6435-490f-8c03-0d4611b6dc93", "comment": "Malware payload", "value": "d37886f17b7c22a55c2324439a9fd4bdc02ececa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835500, "uuid": "d20e25a7-1714-41cb-99b3-52398199f698", "comment": "Malware payload", "value": "2eaf05de81cd6d1d1ad8dbf19266d9408cec5e4e33df838f794e18c7b5b075a27aefca72ed62b226bf3298ed2108da6a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835500, "uuid": "1d2e7345-d89e-4d44-8c65-d00b5707e5f5", "value": "DC64AC1EA6D470A3D0752F30947277E44378B8645E8665CE9F842A3D2DB1BC1E8F2EC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835500, "uuid": "fbea0f1d-1389-4632-ab28-79a9ea6691a8", "value": "7e13866414f4ebd95471c7c78ee916de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835500, "uuid": "4e01d1b2-3939-42ae-a9f0-1c97f6bac2ff", "value": "3072:1WnEuCiqVscRUsRhg1siZ36ymv0HCI6r21ZuCM82+JZcyMm1HlB1bFeZvYeCow0J:1wPC99RUF1bK8CprkM82+oIRpjeCoJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617835500, "uuid": "0e0cdce3-d0e9-46f7-9c3e-205a87616a23", "value": 330920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617835500, "uuid": "0e68625c-f2ad-4d85-bb07-b43e216401c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835500, "uuid": "c0474025-1e6f-4bc9-a855-b998ed15c298", "value": "LCSXS44U22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe79fbd-9780-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617786238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786238, "uuid": "e497f42e-733e-4bc4-a453-5f3658fed025", "comment": "Malware payload (IcedID)", "value": "766f5bb363db9a966b613a42a118798a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786238, "uuid": "d36b2931-1fd4-410d-aad4-ee35823c4924", "comment": "Malware payload (IcedID)", "value": "9952ce93009bb9fe2b687053da8db61f551cd524ca2691669257c35aaba18832", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786238, "uuid": "13fcc4d6-d7f8-42d8-830c-2be6f0f443f5", "comment": "Malware payload (IcedID)", "value": "57e67742fd7e7fa0badddca5b2cceb4cf09048a7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617786238, "uuid": "5c2687c5-a678-4c34-90ae-85dd6a4e068c", "comment": "Malware payload (IcedID)", "value": "3bf48b8acd76b1240cc75332960a4c19738fa15de14e8e367fe4857f9e7e6c29772ed72694d4a2d6be3d9f22379bbe66", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786238, "uuid": "802476f9-b1e3-42ca-a9a8-749d6e397ca0", "value": "B4B3B0BCCB06B0A7DA54DF3C854AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786238, "uuid": "f945c237-b1c7-40cf-919b-7c72108798fd", "value": "3072:Q26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:QLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617786238, "uuid": "b2450371-3fec-4456-b120-01761d478cbd", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617786238, "uuid": "5859dbfc-8bfe-4e12-aaea-3de8d6720924", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617786238, "uuid": "74cd312e-c408-435c-a6c9-d9e47f055ef8", "value": "document-933340782.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6747c382-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824556, "uuid": "86660cd9-41e6-4520-951d-cacb88b1ece2", "comment": "Malware payload (Dridex)", "value": "4e23fa2260dedf4a0f6c2dee0c6719d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824556, "uuid": "bcbf3617-34b8-4b76-a513-9383a6eab8a4", "comment": "Malware payload (Dridex)", "value": "9a85428e5ba7b797f68fd089abeb9626c1f0b924d990c54de92fcc81c9a61ea8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824556, "uuid": "74c235e7-f7cd-4eb5-8d20-743cf127ec8d", "comment": "Malware payload (Dridex)", "value": "b1996bdef30a099da4c59f76991683339fe2e0c2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824556, "uuid": "be0c0e5d-e835-421a-80cc-127755e6fb4b", "comment": "Malware payload (Dridex)", "value": "41e6bc250cc74c4a06c055e1087ca202648ce20a4f3145fd0da309303371c9963fee1caa0ca5900822151b3a0ee6d574", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824556, "uuid": "94e7efa9-aafc-44b2-a759-fa0ffac576a6", "value": "CD249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824556, "uuid": "85dd8705-4eb8-4d31-88f5-fe986ce53947", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824556, "uuid": "b33d627a-d966-47ae-9347-c14c508d568d", "value": "3072:l0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:opepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824556, "uuid": "e0c4bd4a-30c0-4320-af6e-f0377f8e0087", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824556, "uuid": "3fbc0a01-184a-4ba1-bde1-bd589a745a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824556, "uuid": "cd0195cc-4566-4546-9d36-97091ac2d5fc", "value": "9a85428e5ba7b797f68fd089abeb9626c1f0b924d990c54de92fcc81c9a61ea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae9d1ce-97a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617801745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801745, "uuid": "39cab749-8c81-4598-927c-41a034fe6d69", "comment": "Malware payload (AZORult)", "value": "390ac19e8d4b6eba1a936a5052b6babf", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801745, "uuid": "e36b6539-01b9-4ef8-80d9-c23fd3cbb919", "comment": "Malware payload (AZORult)", "value": "9aee92df3530cb75fb37ffe332199dc0a61718a010d34fc48dbbe16fdd1b3154", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801745, "uuid": "1cd128ee-c837-4664-ab31-0b46a8c4c21b", "comment": "Malware payload (AZORult)", "value": "1700afbdafcf20ee9deeee4165f6758403e7f43a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801745, "uuid": "a0b6c2e3-daac-4f3a-bba5-52ec468441aa", "comment": "Malware payload (AZORult)", "value": "50d3d3adcd78c222de286765578fc17e8e12aa8d98aa47bf202df6e51bd86f21e9719dbc97938c9de94c012e2a7fb0f8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801745, "uuid": "81b9e51a-f323-4e89-bf6b-3371ead7fce5", "value": "51E3121966E044E7D89209340777B63AE37B8200242D2ACBCB1D9F3E2E769D3457C2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801745, "uuid": "a819bbc0-a81c-47b3-aa34-a7be902ea3a4", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801745, "uuid": "15e36aab-d089-4fa2-a6ec-bc7576a8ecf2", "value": "3072:NeYBCwqDxkJ0zzk3nW32gIEsc28HAmXmC6eLBJqoYovx14eN0ORow96H3r:NDIFYw2dEsN8HAUNPYMx145tw96H3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617801745, "uuid": "ab6d915f-99b3-49a3-88a6-a8e0300d25c7", "value": 154863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617801745, "uuid": "a1f6e7d5-ec24-4b14-b909-deec478df337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801745, "uuid": "577dc6d2-5bab-4185-87c5-b7242b809222", "value": "GRS66701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875cb4ea-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617775217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775217, "uuid": "f3c74aa4-24a4-4a12-9815-1817a82fc31c", "comment": "Malware payload (AZORult)", "value": "e67df1e7a4ac3610c63ebf43ce57c328", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775217, "uuid": "02752454-4a4e-4564-8ee4-a94113408afa", "comment": "Malware payload (AZORult)", "value": "9b96d29bf6c5183b4ab838883d42b2bf936eee44dd1a714240ce21277b85bde7", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775217, "uuid": "addaf1df-6a8d-4907-9a6c-52c706b573ef", "comment": "Malware payload (AZORult)", "value": "2d75820eb98168bf6f7beebb3da3f18e37b424f4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775217, "uuid": "52d960af-5ac8-4907-9bdf-b373443e0f96", "comment": "Malware payload (AZORult)", "value": "39dae3284c248d783e49c0e7326685b02d4f3c4fffa41bae5bf00084a55b86141f82fc7523a84d616cb0d7911c44a85a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775217, "uuid": "ca4553a0-e4cd-4232-85d5-09e8a134f897", "value": "5C550150B746CA51C89907F1D9A784830375FCC82C23DFA6698CB2D9363578C8DEAED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775217, "uuid": "77c5348a-049e-4e6c-bf7c-58240cd61c0c", "value": "12288:blOl1+yzsXbe6KLkxL0aVttTT0YKmcdBh27UkV9dL0DvsPzEswvPS:ZOlshS63xLdrMNPBh2Tx0QzP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775217, "uuid": "39fe53e3-4821-47a7-a815-219454cb78e1", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775217, "uuid": "2586d4b2-e175-4b4f-9f32-20aeec09a555", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775217, "uuid": "b0b98f28-3bf6-4904-8d4a-5e43d9fdba3b", "value": "Credit Advice -TT6635993652908.PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ab8323-97b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617810968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810968, "uuid": "d811452e-31af-4e55-abeb-ce7d3d78b261", "comment": "Malware payload (AgentTesla)", "value": "69ed1d226286c4a6092e55c72a7df833", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810968, "uuid": "37e44fc6-8b0c-4f36-9750-88f368799897", "comment": "Malware payload (AgentTesla)", "value": "9d8a92ce7ecb89ded2457f2d7ab9ec5b75dea58d9e94631efe5dbd030fe76cd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810968, "uuid": "91d5c390-f41d-4b9f-a6f0-78514d25d091", "comment": "Malware payload (AgentTesla)", "value": "002b4e1ab3fd34bf59fe07e50fb0accb29bbba23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810968, "uuid": "a49bb787-a144-4efa-9309-c2cf9f54a6b4", "comment": "Malware payload (AgentTesla)", "value": "60509b69bad13372c2ecddb8e1b98ca390d46ab6a0735478269fdd75d68401aef1b8ac36d151079569b6f315cef790df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810968, "uuid": "ef2a346f-dbdc-456d-b0b3-66a525696a01", "value": "0D05F13063AC5749E6BE9BBE4460145017F2B91AE732E30D3DB8128E1E61B81DB73B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810968, "uuid": "8f328458-cebf-48b5-8243-8049776b5571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810968, "uuid": "c0771341-c889-4a38-8635-c5eae1f54293", "value": "24576:CfWHEeTNS6/aNeN8XE4yB0X914qCqYJPa4bTa5pUG:CfWHrTPacNl7aU/xaH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617810968, "uuid": "b1651dfa-00f2-459e-99c2-4c78a09d73fe", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617810968, "uuid": "f7d41821-0c1b-4525-afb5-751f467c8da0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810968, "uuid": "48916b26-899f-4c15-9e97-923d61b127ea", "value": "SecuriteInfo.com.Scr.Malcodegdn30.6111.17377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be168e3-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794338, "uuid": "d73c4840-9e31-47d3-9e39-1f079da5244b", "comment": "Malware payload (SnakeKeylogger)", "value": "a80422c14d9020fac56a564a890e9989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794338, "uuid": "9cc12363-dbac-4ae3-8260-4189c39efad8", "comment": "Malware payload (SnakeKeylogger)", "value": "9d92710a161bdf3bbf19a895ad3f7ee347d283890bd2a40893f3bb6d85b3077c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794338, "uuid": "330328c4-3c37-4d05-aa18-110b27a665d6", "comment": "Malware payload (SnakeKeylogger)", "value": "454339e238e041a56a87b76ead7c2aaf469953b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794338, "uuid": "aba3ad39-91d2-45bd-841f-4db9e9bb8474", "comment": "Malware payload (SnakeKeylogger)", "value": "1177046dd881a66d6f29edf93211d07b6b33d629db85b6c7fffdcf3db790232844856c1e56cb48a6bdeb406b65c8678b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794338, "uuid": "c1f58e5d-3471-4d18-b6d2-aa85ab5c9df3", "value": "6F25E02232989BD6F17E5B329465913013F1B88FE366D64E3CDCA39C14B2BC1C25A776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794338, "uuid": "94429921-9e40-45e0-bf65-485b4dc5b2b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794338, "uuid": "1416f220-ad4b-45d9-8387-b94dec525437", "value": "24576:r3bOx1cDn3DmS6pUb4aoaJ3IkPNYX3YGJuvHUzvvCOOReYycnlWp:Ox1Wn3DmvpI4aoaDPi3pJ9v7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794338, "uuid": "f0cdf21a-055f-401f-9db2-f9cf28f05ae5", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794338, "uuid": "da24a207-1d57-4b68-8f12-7ad53758b5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794338, "uuid": "035be16d-80d2-418a-89c2-545fc941578c", "value": "Yeni siparis _WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eda3f6c-975c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617770801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617770801, "uuid": "b03d46d2-a46d-420a-aca2-951b7f1c4805", "comment": "Malware payload", "value": "a51cb52e94d9ee2769dd12e18a826b42", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617770801, "uuid": "488298a4-02d5-49d0-95af-3a7fa05fde46", "comment": "Malware payload", "value": "9dbe7406d3f32fe99d0542d0d787af95a21c0f3b819da42decb0766d82147ad5", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617770801, "uuid": "4255cd98-0e5f-400b-a7a5-450811f172ea", "comment": "Malware payload", "value": "cdbbf62cd02b281f558d4600f97613f15dbdf85d", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617770801, "uuid": "414d7d40-36e8-4fd0-9776-490d8726d58d", "comment": "Malware payload", "value": "1d6ba1c3507d7b2513ef1ef682c9bcbf95953bd1f40c29dea596e76848ff61acb4a2f7fe6ab9e711242daf63283625ab", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617770801, "uuid": "f762fa9e-bf19-4621-9d71-7890b2ff74a3", "value": "F8311B493C4DBB6F424E10110142A23C5A2A9778D16134972ABABDA256A15AF681F7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617770801, "uuid": "2afa654d-ba07-4408-ab2d-51645a3bc89f", "value": "24:Xsdhnx1RNukD1al4A+pTJ27gYFxPKy6qt2FLUfigMfZSLHO80DjPPrd:XsdhnxNukha+AGTJSKy6qtGLUffMhSLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617770801, "uuid": "316bbef6-c013-4915-8aa1-6495d71fecb5", "value": 1467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617770801, "uuid": "94a7ab43-4d32-4e4b-9238-28c8be5b8474", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617770801, "uuid": "4536b86e-786e-4b68-a2ea-83c7042ca094", "value": "base64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48f67b7-97d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823880, "uuid": "9f14283c-eec9-4c9b-8112-97712df128d2", "comment": "Malware payload (Dridex)", "value": "57f7b4e8e21197a97b2e1a092a6ba61a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823880, "uuid": "8cc1d7d7-a649-4e55-a4a0-ae50f8cfa27d", "comment": "Malware payload (Dridex)", "value": "9df09df478e86a66db31ea2cfa5ee69fe79453cd7d6c1e0a66c077c327d61f34", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823880, "uuid": "2a1c11ab-783d-4684-bb15-6d3e760d552a", "comment": "Malware payload (Dridex)", "value": "4d13cfdb116acc293fc1f6d70ecec937ad6dc775", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823880, "uuid": "7bb8aeff-f698-4184-a0a3-6d0b7d4bc98e", "comment": "Malware payload (Dridex)", "value": "b542c937b7c801affa78378d79f83552fb657d28dbcca593687122eabb3689da5f2a71211667592b1d03fa0def7e862d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823880, "uuid": "987ec763-7b51-456b-b746-ba2a07fe96af", "value": "1314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823880, "uuid": "8e182196-d401-445d-9dd8-0a7a2ae3062c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823880, "uuid": "65581415-32e2-44fb-9b6a-445ea608163f", "value": "3072:eBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:eBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823880, "uuid": "bdacc8aa-ff18-402a-ac48-ffedd406d187", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823880, "uuid": "7fd06980-137d-4480-9ba2-c9a01eff4a6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823880, "uuid": "8d3e406d-a961-4bbc-80e9-88aa6748e2d4", "value": "9df09df478e86a66db31ea2cfa5ee69fe79453cd7d6c1e0a66c077c327d61f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6083d7f0-97dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617826262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826262, "uuid": "73d3b769-6cf7-49b7-becd-8607f39d2d4f", "comment": "Malware payload (AgentTesla)", "value": "a21c206925ac88b1a203bcccecb8c651", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826262, "uuid": "4e61794b-d372-45cb-9975-880f21abb75d", "comment": "Malware payload (AgentTesla)", "value": "9e1d86ac14cc1d65212852b44b4aafcf79fda770ccf33f7bcc53eb382c74c381", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826262, "uuid": "fbc65bcd-1415-4c40-99c9-3ee4b3415035", "comment": "Malware payload (AgentTesla)", "value": "0fdf7049061a45b302ccbb072b136b08b2f5550a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826262, "uuid": "54410ca5-9c7b-4928-aa48-86d868540438", "comment": "Malware payload (AgentTesla)", "value": "dc788bb0526621010bf705a8ae8da362af787aa741bfd1eb3b794a447c497ecd784eb59646df8698ecd00271cf8d528b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826262, "uuid": "eb3277c0-55bc-43c0-984f-535e1fee9134", "value": "2605F07023E85B4AE6BEABB91170051017F6B50BE732EA1C3D78129E1E72B819773717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826262, "uuid": "8e86a791-f797-4a03-a5f0-84598ef0bed5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826262, "uuid": "6643f65e-c0d0-4835-81df-117ea9a4340d", "value": "12288:ovLhE1DJRN2GIqbgvp2N5OK405/3Ju/MOK6NtBro7JFlWHTSnVtVh3oy5Lup:4OPRN2GKYNM8/3Jv/JnlmTOH3oyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617826262, "uuid": "6b16904c-45ab-4fd4-bfef-532181d16c86", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617826262, "uuid": "6ca78a2f-5d31-41f5-9aab-2f2f62d284db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826262, "uuid": "cfcae187-fb5e-4c10-8163-5cd9d7e1040c", "value": "Order-027165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbb7398-97b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617809967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809967, "uuid": "aa932d2b-77ea-4dea-ba52-55315b7fcff2", "comment": "Malware payload (AgentTesla)", "value": "492cd8de25944c5d544ad37f3d4464ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809967, "uuid": "322a2a39-9e07-4248-b586-adf450a3935e", "comment": "Malware payload (AgentTesla)", "value": "9eef66e18d2a8ef5523142dbf4ce58cdf05502582375edc7aac6d0ddad5ff682", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809967, "uuid": "40c03c27-f988-456a-b716-623c48a55cce", "comment": "Malware payload (AgentTesla)", "value": "27617ba6691f87043da41f7257f86a985882f536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809967, "uuid": "23801c61-e4ba-4195-93d9-d3bcc0f2a9c5", "comment": "Malware payload (AgentTesla)", "value": "32242a59f2c6e692ee79d7cdde1965ba512084f9a49617e42021d164afce46ccab102d9df18a7a1af9f3101684830e29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809967, "uuid": "3227c149-e98a-4a39-87ba-0f972ff900e6", "value": "68A422AC3DEC1F8BFE0707700BDE58EE4D7EDE8B6BA4908A114539451539F9B4A9C0A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809967, "uuid": "0cc8ebc8-9c90-4cbf-a95a-899c46790b72", "value": "12288:YP4tfxYDlMYfr8BvwO3OiSbEhl1AT3Q3mTXyUV:YsfxzH1XeiSwpATqmTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617809967, "uuid": "5898cf64-c43a-4b3c-a8a5-58da3934e773", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617809967, "uuid": "81127026-b01c-424f-bf26-0bbcb5e57251", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809967, "uuid": "641e7b60-713d-4f37-88f5-a31286866129", "value": "PO PR 111500976.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41207d71-973e-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1617757920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617757920, "uuid": "2797db99-425e-46f0-bd93-14af6fbf4a9b", "comment": "Malware payload (BazaLoader)", "value": "ac9e6b5f93ae7560c74176cd4ec2d129", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617757920, "uuid": "01240ed6-1171-47b3-bcdb-2fe689fc0823", "comment": "Malware payload (BazaLoader)", "value": "9eefae4b7a4bd95ddd0f411fee8bf9b7e3c4a521064d2c14c77612b5f5e68707", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617757920, "uuid": "0cb061e9-1bca-42a1-9803-34b0c32702ea", "comment": "Malware payload (BazaLoader)", "value": "ee77500c1469c983c811dbfaa03036d7dd87cf8f", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617757920, "uuid": "a28faece-b39f-436e-9e2b-87179dca089e", "comment": "Malware payload (BazaLoader)", "value": "0a893d7050443412efb2e569823c1e4a9f9f54ab8e4536f98fb3794e637c0176f4c7d0985e78ecb666ffc91b16da8b25", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617757920, "uuid": "12ee7ad9-26c3-4d0c-b102-988afec2c333", "value": "C704C1FC5DF41A10EF2490FECEF7D425AB7522CC36D68A09613DE8E0367C9A542E50A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617757920, "uuid": "b8cd39b2-0ccd-4538-9e67-19e60b8eaede", "value": "32856986f7eacdd11a6f4fcbafab0a87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617757920, "uuid": "d6108f25-4ac3-4a96-a1f6-3bab34eec92d", "value": "3072:/be9ljOMYM/NgDZO+jD9qMFGE3TUfK0lK0dc6ek09b+sivDkNZv8Mm0MuCtbnifp:ElqJYNZwD9Ljcz5MyQNZv84wtbnif1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617757920, "uuid": "75e271f9-3651-457f-8080-1e51a32d34a8", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617757920, "uuid": "34b4005d-66e8-4860-be25-c331c672974a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617757920, "uuid": "a1f373f7-b16e-430c-930f-49063af14ccb", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.9611.24005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ade0fc-9779-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617783293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783293, "uuid": "8b280c9c-abbe-4c83-9803-47e933636260", "comment": "Malware payload (AgentTesla)", "value": "84503486fcd35aa7b1f0f2d8dba362a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783293, "uuid": "d35b5500-b6da-42e7-b648-a6ddd1a80a7a", "comment": "Malware payload (AgentTesla)", "value": "9fe434939b17f243fe511a803accc2fcb26a17b7828188c265d73baf4e6a4afe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783293, "uuid": "29ee4984-fd92-467d-b85f-e69fd63bbde1", "comment": "Malware payload (AgentTesla)", "value": "4d347070e76c46163b3793027e5eee21b49b7902", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783293, "uuid": "b0aa0313-8e91-49d5-bcb2-6081977197f9", "comment": "Malware payload (AgentTesla)", "value": "18563eeff908524167af555e9ea993499f63e17a75c84db71fdc019e960add8f3462249a8ebfd64fe17b86547cf8bc07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783293, "uuid": "ac352b48-f227-4cb8-8276-1e527b237915", "value": "980523B272A52B92CA50D2884B3CE7BE1600EDAF6114D6EF584CB841DF8DF6F8987544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783293, "uuid": "fbd6b30d-9e63-4392-a5fb-b44d6206585f", "value": "24576:jcatPdp22cW0GXIaaqkx113tAXG3i6SIk1No:jcax5cpG5f6dAXGy6SjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617783293, "uuid": "24193005-32c5-432d-a1c7-00f4c55603b5", "value": 817023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617783293, "uuid": "10c46aca-d5a5-4dd6-8835-b916351bfd98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783293, "uuid": "98244a47-8ecf-4ee2-be1e-a7f26d45383a", "value": "VAT INVOICE__pdf__________________________.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0046b04f-978e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617792171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792171, "uuid": "f207c1db-58fd-4b21-bc7c-f73d7b359d51", "comment": "Malware payload (AgentTesla)", "value": "bd269eb6898e20115d68c8d2d370252d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792171, "uuid": "f5176481-56ff-44b0-bd75-68ef7737197e", "comment": "Malware payload (AgentTesla)", "value": "9fe4c61297686cf62ba652d93848bf6e64259dc3d219cb0fea6c31a21300df4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792171, "uuid": "ae19e5e1-aa56-4cd0-9e4e-9cdd037e86b4", "comment": "Malware payload (AgentTesla)", "value": "35c6e9fd482c08ce8cef7faf21ddda59300e0b86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617792171, "uuid": "656cc1f3-fb13-4f5d-aee3-78a3de9dbca1", "comment": "Malware payload (AgentTesla)", "value": "c275426b381e0917bf965eb51196367aa44179c70824719111d28a049b217adbb8906c07e3f1a08ff66cac0b3eb0060e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792171, "uuid": "aa63d639-26a8-46cf-a6fb-01b9bc7d888c", "value": "4AE433A067A9EE2AEED21C964371EBD3096C1470F565373D3FB464BD0B00A275E324DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792171, "uuid": "6c337a29-1d5e-440a-b752-21ffc2ba318b", "value": "12288:beXcVMuVfseWsym2BD2pDHgf7jfjIm9Xb86PpF8B1cDY4lK+WpWvnBnkQQ:/SuVfsyS12tAf7DU8L8YJo+JpnkQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617792171, "uuid": "073c6518-5c5e-47a7-9b00-7d3f8a1e506a", "value": 702757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617792171, "uuid": "a0cb7234-567e-428f-83df-522b5a1ec9c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617792171, "uuid": "068ae873-e954-4773-9f9e-1a7564bfd0c1", "value": "Agency Appointment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38ef8b4-97bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617811799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811799, "uuid": "fce0b009-2adc-450f-a66b-0c2f280c1561", "comment": "Malware payload", "value": "a0ef09bb2373b08b7569240372b1b5ce", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811799, "uuid": "715d2ce7-4269-48cd-8d25-46490e7737a0", "comment": "Malware payload", "value": "a05bd354bcb7c1f65be554b13688394ff76fda9f6ae2cc67d3b861c80af6405d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811799, "uuid": "c5da4794-de28-49db-9c77-34a207c233de", "comment": "Malware payload", "value": "d14c8b9a9400b50d01c50a5495444f35c2398142", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811799, "uuid": "7ffda8b7-5ffc-40ff-a4f5-e7297f2dfe47", "comment": "Malware payload", "value": "97c7a68a2f89dc2018af318cf980efdbd208e2433ebd51f4e2cdb52d2fa9c74ede1312caba7bb3f098dfa81a14098ce6", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811799, "uuid": "a92e68e9-3e8a-45a8-9acb-7976eeb44614", "value": "360147282785F2750219224AF222E8099150810807D2FA66C38EDDFBC18EC8E72D87E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811799, "uuid": "97d89ee5-295e-4e78-beaa-0f97e434fc8e", "value": "12:OmszSlmspWlpy8qp25Kk8ono4KNciEDuP2rEyQ79PmsSPA:778C25Kk8xnEDu+r279P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811799, "uuid": "2b659e47-15c8-4eee-a8cb-fa5dfb7fdcac", "value": 695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811799, "uuid": "08b08c62-8940-4e2b-8c0f-fff70fb1e10e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811799, "uuid": "d21f5ee7-12f8-463f-b474-0c5b16446783", "value": "7bst31LJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0c5e18-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824351, "uuid": "39e360f0-3438-47f2-9466-8f523141142e", "comment": "Malware payload (Dridex)", "value": "96b4119db36c7a56e666df3f9d1c9be8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824351, "uuid": "d041020d-5213-4f75-afd4-6147de82cc32", "comment": "Malware payload (Dridex)", "value": "a08463afb0cf99c7917c9d8e7c41529691a2e25af8d35a6ffa2bdc873c444013", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824351, "uuid": "c4422cf3-c203-4501-adf7-584782d1a185", "comment": "Malware payload (Dridex)", "value": "52e2d359f73d3574a894b487edcb2dbb8e5708bd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824351, "uuid": "e412d488-849b-4601-9f77-4ef24670e478", "comment": "Malware payload (Dridex)", "value": "0be194e0c777ead35e31779a46edcf4477fa56b41a9b93c2243392be7c819c258d69affb0c8dec4152abcb2844ee2021", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824351, "uuid": "9ab778cd-80b4-4fb9-9896-9ab91a8dc9f9", "value": "7A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824351, "uuid": "9dfe33ee-789c-49a7-8ac2-aeae1647dab4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824351, "uuid": "299d3733-50e5-4a6f-9b62-39d225cf145b", "value": "3072:R0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:EpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824351, "uuid": "2fd97278-183e-4154-a674-cbaee1ef20c6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824351, "uuid": "9df5251a-bb34-47e8-ab7e-4de3968a20cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824351, "uuid": "d0b04416-1f05-47a6-8bef-01034659a39d", "value": "a08463afb0cf99c7917c9d8e7c41529691a2e25af8d35a6ffa2bdc873c444013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4d8d55-97aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617804562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804562, "uuid": "475d2ef0-5140-493d-9ec0-0363e9ddd347", "comment": "Malware payload", "value": "c05e33d0597f788212b65c77c5a6d092", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804562, "uuid": "d25c0d36-254c-49a9-a904-352007ca59b5", "comment": "Malware payload", "value": "a10417821217d16cace8d20b6c738c0ec6492c41af1c5ca88c81d2f2262892b5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804562, "uuid": "a69cf129-4dd1-4a1b-b6b7-652a8499da5a", "comment": "Malware payload", "value": "7c175bc8f951e2bae994c597b83836e2c2e4aff9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804562, "uuid": "72f22a7b-0fb3-4343-a777-3be08a2cad30", "comment": "Malware payload", "value": "51ca62071906976e69a5f03bd64e10a47049c113e8e6c4452c1576715d98626c0f8a275b8d59f9d88dde2b193b9edaa4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804562, "uuid": "0e5b3b81-bbbe-4475-b891-d20133daadd1", "value": "9D65685203851BBDF59D0EC5C89B205B20F2D46A7D291259ABF36EE7BC3BDC49430A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804562, "uuid": "95f089ff-5aef-400a-950e-5d970c82c88d", "value": "1536:QomxSBssM1oK93OoeJQ8NpGPzW3n32V5915lvztuUdVOt0Dtg3/7jkzXj1OsDeok:JsIVSALhHKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617804562, "uuid": "db649763-0882-4df4-a5b8-2ce29b8947e6", "value": 1503385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617804562, "uuid": "8d105940-731c-4e5d-86a2-42418668faa8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804562, "uuid": "5cbedf5e-8fe2-4621-8a24-b738bd538d82", "value": "my_attach_43773.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226c8c2d-97bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617811985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811985, "uuid": "6837aae7-2a5c-4fe4-b21d-cb32c8d3f413", "comment": "Malware payload (AgentTesla)", "value": "905168545c4219d7b16b6c5b53e43528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811985, "uuid": "afdd6a74-ec8c-4ae0-adb0-eb38583d24f0", "comment": "Malware payload (AgentTesla)", "value": "a12d27e05f48cb8b8298d7c0bdd5b54d8b11b3984ad0daed3ccf4d75bd9fe07a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811985, "uuid": "e9bd362b-f7a5-4992-9e5c-714ac9b7d7d2", "comment": "Malware payload (AgentTesla)", "value": "e35de2c30ab8e94a8d6cdccf9aa50a7b403a1d84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811985, "uuid": "a4776e5f-9d55-497f-9e48-5f1c4b0e6577", "comment": "Malware payload (AgentTesla)", "value": "c4d91c815b8f86a8468d6d84493db9eae45400ecf62f2e1ffa3d5c740f1e0e132c7cf9df40da5749902355a0e2df3a5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811985, "uuid": "14c28cb8-3fd6-4001-97c3-ffdc30c91b6c", "value": "522559132EC4DA5CF0E95B3D51FC40117FA3E886962EDFCA68DB73AD05A1982F161A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811985, "uuid": "f263aadf-36f9-4a05-b02e-86a44129b4ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811985, "uuid": "6c95f8a8-8e0c-4bb5-b406-2e068ab2c84d", "value": "12288:VgbyyRfMJm2DnLm4TYQnrmZodlYok2j5UX/Pv9Dx5Dl8YJi2Y/suGDw8Sf3G:VgbyUkdDn66jiZodzjCJLRJDCsdwr3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811985, "uuid": "1b4124f0-6eef-41af-bdb8-4e8ed8fbc123", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811985, "uuid": "32a6eeaf-1cb7-4f8c-a454-5cdc8e77615a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811985, "uuid": "561dca30-f3b3-4e11-bf56-6c882ec23fe8", "value": "Overdue Payment_USD.106,375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f076882-9778-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617782961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782961, "uuid": "5a5461c2-38ae-4d80-9002-dfc162cfe622", "comment": "Malware payload (AgentTesla)", "value": "dc18cacc17b69f96fa7c29d7c5e19cc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782961, "uuid": "5e97c72a-c1a2-43f3-ac72-d58f97051559", "comment": "Malware payload (AgentTesla)", "value": "a1e022f8f72a15104381489304bbafc899ee65dcbc35f2cd3dfb893012dce206", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782961, "uuid": "684a450d-a77f-457a-b983-7b1d3641837a", "comment": "Malware payload (AgentTesla)", "value": "a6b51c0a5e7fcde39776defeaad59e3a3109e3b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782961, "uuid": "b2b45eaa-f1cf-4879-be9c-0771046bd69a", "comment": "Malware payload (AgentTesla)", "value": "28c4591a8dcf102a00884cecf58f2adbc7c0b0af1cbf9b6aba9d050c63dd4cc2dda8466c54c7f8c546867fc78c53a912", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782961, "uuid": "2a589b48-29ca-40dd-b218-31ab1302ef65", "value": "25256940E340966AC4780DF545A142438AE4AFDA2B03BFC6F74775FFA1326CA6D8D94E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782961, "uuid": "06fbda65-9e9a-44e2-8d80-626cd68f8a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782961, "uuid": "ad0ce09f-a8d2-495a-868f-033a7a1ab51b", "value": "12288:98dlj+yzsrWXM6ij7iVeP06K4vk6EyN4NUBJwWlKuR2nzYdU/:OdlihUM3jOVK074vqyN4qB6WIW2Mu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617782961, "uuid": "5206750f-b062-4d3d-9275-6e83ab13f776", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617782961, "uuid": "df4d71be-67bd-4047-a7aa-26b6af71ff31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782961, "uuid": "e77537b5-d021-4a61-9670-155648359c37", "value": "yd9Vhnf8orzOlAq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2374b1f5-975f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617772043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772043, "uuid": "5d637943-0e44-42cf-81ec-61fea47e317f", "comment": "Malware payload (Formbook)", "value": "252556c05551372633042fcc7b142d54", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772043, "uuid": "6988e6a4-e9c4-4cd2-bf85-4d5f3ba5c54b", "comment": "Malware payload (Formbook)", "value": "a20ab7a4f9d752a616bf2fee4c0aab0565ac9d8e442b483cb8eaa1e726103405", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772043, "uuid": "95f6d77d-82ae-4d3f-be03-878061f7c7df", "comment": "Malware payload (Formbook)", "value": "5d39c6c34025c2a12d01277765c225e6267dd21b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772043, "uuid": "e3885996-756c-4fa7-b51b-84d475c8cf31", "comment": "Malware payload (Formbook)", "value": "17b8c92e88f0dfdf0fbef24a51ab5b05d6aac42f2511e18843c1a6928bc5f48e59ca35fbcaafa01f3a986dd385ce9130", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772043, "uuid": "5e59d0c5-d51b-4bb6-97d2-b6af38422707", "value": "EC45E71031FB601DF4F3AF716FD8B6AA1E6FBD30651DB0B86910071A8E25D40AEE6671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772043, "uuid": "3c91cb49-006a-4f54-8928-4cb468bdeec1", "value": "768:/60wIxsfx8I3yCSNGDINCCpirqB9h+cEO9TuCRJQOU2G:C0wjfx8VCBINCCpirqB/+cEmTot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772043, "uuid": "274bde0c-becb-48ce-8f12-361ad45156d3", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772043, "uuid": "05ab97a7-0b90-4822-a7ba-386854145016", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772043, "uuid": "e23845c2-9c12-4bea-97bd-05304079b458", "value": "Payment Confirmation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04a30c7-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774830, "uuid": "2150d21b-880f-4bed-9f79-d9ad8f3c08b3", "comment": "Malware payload (Formbook)", "value": "c8f8c392bd5d2d53168ec6ac9c5d62dd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774830, "uuid": "e1dbfe92-5c6c-4ebe-9e5c-fb4e89f80b80", "comment": "Malware payload (Formbook)", "value": "a34d50edbd87c99b41bc37b2059011d778a15eb07ab66065e8eed5cd15f378fa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774830, "uuid": "ae93a6d8-900f-4b54-b742-f0c2b052df84", "comment": "Malware payload (Formbook)", "value": "9c8d0be840eecc2fd307e4b391f139057833766d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774830, "uuid": "a4c48821-dcc8-4597-8806-30a0097d90a8", "comment": "Malware payload (Formbook)", "value": "93473701845d25c6f5f2a893b8ec198d6d20efd30250b88028273a1ae2bcca2e4c24cdc2358f561e0585e06331afd65e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774830, "uuid": "1cb32376-400e-4190-8bd6-3e2336dcf099", "value": "2372D048BD6E7D4A39D7F73C03E17A913C81B20C4097C24A1F4A91D34979F845F66E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774830, "uuid": "101376d8-62f0-4eca-9295-c1de8101b055", "value": "384:lNg992GVKjNtH2nVwxeh+WyNctsr9A3hdvEhylgtYW:7lN52nixe4nGg4NDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774830, "uuid": "c3e3a5c0-e2dd-42e6-8cce-9fb4015690e4", "value": 16886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774830, "uuid": "f3308dab-1c05-471c-94a2-77c9d0505620", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774830, "uuid": "c7e833c5-39e2-48f7-96d7-7ad4e053b695", "value": "BL836477488575.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e1a830-97d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617821572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821572, "uuid": "d812d2f3-dd8a-41fc-9d55-325cfac2d5ab", "comment": "Malware payload (Dridex)", "value": "5c32a32ffef07a48e061d157258f5e46", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821572, "uuid": "a9b3c53a-d75e-4e56-8515-1f43d09f1bfc", "comment": "Malware payload (Dridex)", "value": "a3beb49057ff3b774f585c487103ac20a8d467f7d3bb527a23e54edc808692bf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821572, "uuid": "6713cbf7-0b86-45f4-990b-0a0ccedfb971", "comment": "Malware payload (Dridex)", "value": "5dfacbc14b6d350baf3eb9bcc7ac4c50f0151570", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821572, "uuid": "bd9be1e0-e133-4084-9c81-89fe8c0f6b3f", "comment": "Malware payload (Dridex)", "value": "99a2aedec5dc07eb62300117805cf5a5cacad0b3fccf54b282b10dfb575c5b076c13975cc778c11ed1a6fa875bd6369b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821572, "uuid": "b0f464ef-3f4b-4adc-95cc-28d5603363fb", "value": "0D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821572, "uuid": "414fd675-8695-49b5-ad9e-367f2d5f3121", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821572, "uuid": "46affcb9-5ea2-45f1-814d-2d13eaba5e39", "value": "3072:3BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:3BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821572, "uuid": "ba7373c5-7eab-4d8f-9c40-385039a975f0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821572, "uuid": "82c89de8-b034-417e-84fa-93b3426ab226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821572, "uuid": "0e2e685b-5342-4abd-b4b1-aa06754a8caf", "value": "a3beb49057ff3b774f585c487103ac20a8d467f7d3bb527a23e54edc808692bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7a6ca9-97dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617826261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826261, "uuid": "a7fa920f-7e63-4377-91bc-f80b3f8176eb", "comment": "Malware payload (AgentTesla)", "value": "8085d4b82960bdd4fe47b49f75189721", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826261, "uuid": "211180f3-c6d1-4c96-aa96-a886ea6fc42c", "comment": "Malware payload (AgentTesla)", "value": "a3e8cfa87951b894bb83d4169e76c6f1874bf67d104489927efd55dea0d14541", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826261, "uuid": "34d68bc4-3e61-4cba-985d-92c812efe534", "comment": "Malware payload (AgentTesla)", "value": "be0cd034461041650d36a5ed0cb6846097756099", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617826261, "uuid": "2e49c0fa-4e5f-4f72-9459-f2b594a8a5b2", "comment": "Malware payload (AgentTesla)", "value": "dae4837b199d7094ba17e78f1b3acbf9297c158d8237a618d9dd3bb52e414d189b14b476f687dc37027f5a4af0a3d854", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826261, "uuid": "aae9c002-af33-48b1-b5da-c341651e8e57", "value": "B6F4238E5EEFD8CD6649BADC37A609201AB8BE41CB575C7143111A5B2FB48D04AAB309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826261, "uuid": "714d1069-17db-4348-aaa0-0742568cc7fa", "value": "12288:tymUHR92GkqM6o9pSxriK425p3Jq/OOKsNt376J13ZWHLSlVvBh9A65Vu9:tymUH/2G8hQxOqp3JT/fRZmLCx9A6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617826261, "uuid": "91008199-e3d8-477b-abdb-3967197f5850", "value": 741341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617826261, "uuid": "eb9f9ad3-7c83-41d5-abbd-46a1d43ea412", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617826261, "uuid": "c030a726-5edd-458a-9a6d-aed72ce2290c", "value": "Order-027165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183e3ae3-97a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617802948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802948, "uuid": "ce7f285a-190f-4e2e-81f3-67135cb580fb", "comment": "Malware payload (AgentTesla)", "value": "d5dac1559e19cad5c7e1632473b279b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802948, "uuid": "64aafa2a-bb6a-43a3-82df-df776b99959c", "comment": "Malware payload (AgentTesla)", "value": "a45034b62741b8fc22be23c74ec28222b15f64fbabf4f5022d17548acce83a35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802948, "uuid": "8cd6c688-be34-4692-b639-63eafa25596c", "comment": "Malware payload (AgentTesla)", "value": "e0f0d90733998f6385a233f32d0ef04075e916e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617802948, "uuid": "af6b1055-ffec-4b65-b1b8-3c6254f89243", "comment": "Malware payload (AgentTesla)", "value": "e4b04412217f0377e06d4032c6ca58dee5f3ad0aca08346b8b3decb759fa5e2352c51d7950fcea7125f93e16e58b4b6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802948, "uuid": "894a2327-af36-449d-9c6a-6428baf66782", "value": "4B0501267BA8DBA1E07E93B50632842007F1FD3AE726E51D7DD471CD1A72B1046B3E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802948, "uuid": "5d4f8663-f5f8-454b-883b-20a036e626f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802948, "uuid": "ec7130d7-5071-480e-b846-1b8d89e34745", "value": "12288:NEojvhvpjiMQzrFknDTS1mKGRgTyTLF/xU9oMC+RASBRTRLpUmK0l+j:dhpjiFl1GRgT8pU9eSBJ60l+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617802948, "uuid": "cfe0e568-5206-4481-8f7a-c29443c6cd1a", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617802948, "uuid": "37aa00b3-5606-4308-a9c3-42391617ed42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617802948, "uuid": "756105d9-b5e5-4d4a-8257-dd3c3fb597d6", "value": "BANK PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510012ea-97a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617800037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800037, "uuid": "cb6b11dc-cc32-4a1d-886c-19f1b9691c76", "comment": "Malware payload (AgentTesla)", "value": "d8bb86c3811d7dc9999d119d36c506fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800037, "uuid": "8c118a8d-6cfb-434a-9f7f-1f195300c346", "comment": "Malware payload (AgentTesla)", "value": "a4ef9224b2088f526fd29e2aac43903ac53113e93a7bb84d2c53de27ff642e1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800037, "uuid": "941cb86d-a222-4bf8-8da3-b326f9cbd345", "comment": "Malware payload (AgentTesla)", "value": "5ce19ddfbd65bfca845d9fe233d137e08dc264c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800037, "uuid": "b65fae81-8d27-401c-b37b-5420be6b3a97", "comment": "Malware payload (AgentTesla)", "value": "3166fdca82aef5f8ef2262d945f17822cb92f340187802df76c8bd1f13aaee2be86f69102750a6b5d6e96def462c26b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800037, "uuid": "bb6b372b-3447-402e-9fdb-1dd46e932fe6", "value": "31F43344A6B45A783A1D0D434AD7F6145A3B58ECF9F618CC4C0EACFC7052F53E8AB622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800037, "uuid": "8daea48b-7dd3-455e-82be-de49d08b08c0", "value": "12288:ElERhF+Mu5HJpXrXL5hbhOTQP9YIcyk4lCNt0IKqYT7QA9CZ6qptmJrTM4as5S:EizqTXL5OsP2I7ll80IKqYT0t6ctkr/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617800037, "uuid": "8c1f1c07-b124-4208-b13d-97476000b787", "value": 750977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617800037, "uuid": "0efa2cfe-824c-433b-9084-d4dd0ff44806", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800037, "uuid": "4fa5345d-6bd1-411b-99ce-0814b13b54ad", "value": "LIHUA Technology (HK) order form.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a855c87-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824534, "uuid": "0c237c1f-9c5e-4124-8edd-3edcae167028", "comment": "Malware payload (Dridex)", "value": "ed33a690de55da98de93034b31dce4b9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824534, "uuid": "07f0244c-6883-4d55-9ce9-420ffb874dfd", "comment": "Malware payload (Dridex)", "value": "a4f4980ac7f4fbcb3de7bb97fd177bf992dbd24c86f61a4b83fe46605c4d099a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824534, "uuid": "64da9bc0-9907-44a0-87e2-2a4c40d2508c", "comment": "Malware payload (Dridex)", "value": "e1315e20c2b80c71db98ec28a163f64399de1836", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824534, "uuid": "512b6111-1bbf-498e-b03f-cd579fa665f6", "comment": "Malware payload (Dridex)", "value": "a269c8ad4d05bc9f6f93023bada2db6b2120dd4ea5c8278d5695140bffa91093e87c614aca6c58107a046919e4f737c4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824534, "uuid": "15fd5960-f349-496f-b603-1429a6ac9136", "value": "86249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824534, "uuid": "6706ab85-7030-4469-87a8-2b2e85473128", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824534, "uuid": "46243422-93a4-406c-99a3-81e24e5b0aa7", "value": "3072:o0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:jpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824534, "uuid": "1e45baaf-a444-48f1-bccd-d042e7570fe3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824534, "uuid": "37ac754f-ff26-47c0-bb15-7b70a9d87cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824534, "uuid": "60f1ed93-9e5e-475a-9a19-c2f7f10e2c26", "value": "a4f4980ac7f4fbcb3de7bb97fd177bf992dbd24c86f61a4b83fe46605c4d099a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312d3103-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794400, "uuid": "8d288f4b-bbfc-4b8d-905e-d7d14ba72894", "comment": "Malware payload (AgentTesla)", "value": "af222e4c07e6ee91efd3efe616bc550b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794400, "uuid": "a0bb6b76-98d7-4855-a64a-04815a4af2a8", "comment": "Malware payload (AgentTesla)", "value": "a659a457c8954db3ca3bd4e5f48bc06f9636885aa9f1d51a2348a029b30f79cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794400, "uuid": "87b945fe-5147-4f01-b815-9f9919c8e323", "comment": "Malware payload (AgentTesla)", "value": "a3745f9a26352dd28498282d05335a03dab7d6ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794400, "uuid": "78d5ac93-8a76-489b-9c56-90092198b176", "comment": "Malware payload (AgentTesla)", "value": "661f040d8133446f9e893c06d5bdd2cf8fe37f5a506f1feca68570ebb9a6367cca745cc1266e04604132a0d18c976c1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794400, "uuid": "25efebdc-2838-498b-9b80-80a9b661471a", "value": "2D23D0C87E7200A9F4CB183A0FB1B7A2A7E1A7D105424C25903CE94DDD5EB162D7DF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794400, "uuid": "ddabc793-6b0e-4311-a3ea-3655a76cc0f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794400, "uuid": "71956605-9ca1-403c-80e5-dfb9cef89599", "value": "768:GFo89K0KmXZKrGTd5tRgvfkDmt9a5gVuYl3TyWTNf6UKkvh:GlKE8rGTdnDmt9a5gVuYl3TyWTNf6UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794400, "uuid": "79a031cf-a127-427f-b98c-6c8c8a7e430b", "value": 46200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794400, "uuid": "e6883ee3-e553-4d76-927a-9cc818f6b8f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794400, "uuid": "3139f092-8afe-49f2-b454-b4c388e99124", "value": "Krishna Gangaa Enviro System Pvt Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec220b0-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794450, "uuid": "a875df64-0867-437a-9761-41820aaa04e5", "comment": "Malware payload (Formbook)", "value": "1ac4a8eadca18d6143427c16c19a5471", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794450, "uuid": "e509bbe5-cd3f-4b09-9701-8bb15d1eddec", "comment": "Malware payload (Formbook)", "value": "a7318a6230ca32e4641e37deaac455e514524fabc67ca51afa3c7f1abfd5e825", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794450, "uuid": "21283dc3-c7de-4e16-ac66-6ec46b876185", "comment": "Malware payload (Formbook)", "value": "a23a59f838525cf863370c25591e8d8b33a3d3a7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794450, "uuid": "ed74fd2b-1a63-4556-8266-3153974b68d2", "comment": "Malware payload (Formbook)", "value": "e8143db76bcabd2ce0fa1b84b1d208e30ff00bfebb014bf061e81b4f1076a1cef4d2fe718d94d5b13e9eca3eb410697e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794450, "uuid": "f02539ae-c94c-4bc9-b03e-90a19d8911f8", "value": "77E423BAB8559E039426E16DCC0C65FE5030DA62505B3BE9B03D87CE46FBA8189BD1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794450, "uuid": "d477fd7c-6b32-48e7-b1dd-b13a431fbacf", "value": "12288:+hE6/jIZTVkzPUz1SB3DZoNju8rCOgTDurAJt/1xaYbemVbNN4AqgW:SRzPCkx9oU8xgXJttxaYbHbk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794450, "uuid": "fdd9a9e2-3bd2-438b-9976-6cdafa766b46", "value": 702717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794450, "uuid": "f992a975-dcc8-482b-ba2e-4b362d70212a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794450, "uuid": "4bec01df-aa26-4597-8516-4b213461eef0", "value": "INVOICE for Order PIEX310113978.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b99a21f-9764-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617774339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774339, "uuid": "d28d15db-65a0-4519-90ae-5774be81b58b", "comment": "Malware payload (Gozi)", "value": "889194eb6a3904f14ab7ffd672c97ad5", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774339, "uuid": "3b176c0f-2f08-4783-a483-b50a5d3d8744", "comment": "Malware payload (Gozi)", "value": "a80382d030b0c292a73e83cdcbd0f4e30f43f43bd7d2e3250dcf83e1d2d51503", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774339, "uuid": "586fecc5-c622-4845-ae93-0c5535c27d1e", "comment": "Malware payload (Gozi)", "value": "983b743e8d66666d2262fe6f6d21c9950ea64bdc", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774339, "uuid": "5fecd4c7-2433-4791-9687-91b37df61854", "comment": "Malware payload (Gozi)", "value": "e0ecfe009b6b4bf6b0ce761e0dc13dcd358bfae8b051fcddd8f1092037bfedac83156b100fc9d554904e51729d451d6f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774339, "uuid": "1e0c8d4a-eec8-41a5-a251-b1c91d2a599c", "value": "DB73F1B597D96C08C0B5DA75F31B19B0D26E1844841FEC6E3206E84D5AE52C78FACB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774339, "uuid": "5bb2624b-f20c-4791-9aa5-ce3becf74178", "value": "1536:ZUwcQTnrmMFOxW9cnGV67h5KSqhbPeB5FSJUfrcz0YW2fR3e:QQTnCMFOxW9cGV67h5KSqVPeBHRjy0YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774339, "uuid": "c4faa73d-84e5-4dea-914f-88305bbb9541", "value": 74635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774339, "uuid": "d2486ba8-c2ad-4325-9552-c27e318d7f0b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774339, "uuid": "7336801f-7945-412a-be7c-58744475d743", "value": "a80382d030b0c292a73e83cdcbd0f4e30f43f43bd7d2e3250dcf83e1d2d51503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e8c0b5-9796-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617795940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795940, "uuid": "34b53b33-67c6-43ed-9d1d-9b67b1eee11e", "comment": "Malware payload (SnakeKeylogger)", "value": "2d1b18ff688a3c2c4fe5a6aac9484506", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795940, "uuid": "3a102448-041c-4e23-91f7-1fe83beec790", "comment": "Malware payload (SnakeKeylogger)", "value": "a8e9f3f0998e02c10746fdb4084dfe395b3bdba7451962b16acb7e34af8fa2e2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795940, "uuid": "4508263a-76db-481d-ba36-75854b324282", "comment": "Malware payload (SnakeKeylogger)", "value": "e918001151b9336200db19980cb87446047f01ad", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617795940, "uuid": "25b9272b-07a1-4926-bc20-8a6975f016d2", "comment": "Malware payload (SnakeKeylogger)", "value": "ef85862dd794e996bf8167e31504a9c90d77f3405c156ecfcb697befe14028ea1c18b0a6b8d6432de03451383b8876fa", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795940, "uuid": "22dc6c79-bc24-4c81-8fc2-4fae14180df9", "value": "BE05013E76489F53C13C10BE02C6A2411AF1AF9AE24FD76A3CD931E997F6B452722D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795940, "uuid": "ae1ae950-6bab-4a9d-bf7c-76ad16d8662f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795940, "uuid": "09f8b4e0-a047-47bd-9240-3d013a3e0bbd", "value": "24576:Tk664+g/DbT1x4qPllx0VVUHIRXgTGBOjvMA8NW:97+Mb4qPrEaGB2EA8NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617795940, "uuid": "9d5a9f19-608d-465c-b7ae-683f2c870536", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617795940, "uuid": "dacedc60-4a66-4a35-8f52-5f7d4920e27a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617795940, "uuid": "4ff10888-f8d1-4f7f-be67-b022f924ae95", "value": "EMPRESA SUMPEX TRADE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc592b10-97a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617800647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800647, "uuid": "cc6d1982-dc01-45cb-a82c-f8e462962305", "comment": "Malware payload", "value": "d823217c2e13489813abfa3219c5fe31", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800647, "uuid": "ec3fc5d9-c0ef-4d26-a41d-ca80866c8d72", "comment": "Malware payload", "value": "aa249a441e28a51ce1a3995f292e998979d5727c6f0f0439bc50136225e8f7a8", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800647, "uuid": "fe51b0a4-d6fe-4751-a51d-ce8c22e24ef7", "comment": "Malware payload", "value": "697b6b958e542b751ae806a83fe766526176c4a5", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800647, "uuid": "c9de2473-44b9-4bde-953c-a66069208ebf", "comment": "Malware payload", "value": "da1a0d0b0494dd6f6b6ecc6f7e87b9cf29854030f01fc5483a7cd2008d645aab515520fdeadceba8aa7da5a6ee1ef0f1", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800647, "uuid": "6b385f63-f2ad-4db8-96e7-01aa6410c16c", "value": "B4F4334148CBEA7595493485D34BFC14EA8A3D9CBC346A76ACE0277FE80B50DCC49BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800647, "uuid": "9b39ab5d-15ba-494e-9b8a-2e2d920c37a2", "value": "12288:aKriJzhG4j11YMD5VJzn16e6rryFIBpXDm525OLj70SwbUFWo3BnQOyGgkVUkzZW:NkzhG4lD5rTwDra528j0SUUFW4Q/Gf3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617800647, "uuid": "f485f43a-40b8-4226-8145-e943749ddead", "value": 782266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617800647, "uuid": "f84f061a-7047-4395-993c-0ae49a49ccf7", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800647, "uuid": "7f370d32-186e-435a-a9db-b9bd16a84192", "value": "New Order_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ed0aec-979c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617798487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798487, "uuid": "30c531c6-0793-4456-9a6c-4795e93de7e0", "comment": "Malware payload (AgentTesla)", "value": "02ae3b2e173ee72bff3bc4041f072bed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798487, "uuid": "5a88e96c-e147-4798-a541-7700d759a4e0", "comment": "Malware payload (AgentTesla)", "value": "aa5b85db4f59d927b0815cc45e159e9b1496943b440bafb8efc47bd9ea5f6c5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798487, "uuid": "91cc1b44-2242-49cf-8d93-88140894f31c", "comment": "Malware payload (AgentTesla)", "value": "c321d9a5cee7556df958f5d0d483cce84640d529", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798487, "uuid": "6f2b1811-39f7-4894-bf1a-43094a5d803b", "comment": "Malware payload (AgentTesla)", "value": "d645226508629634b7478abaa8d7a465de36234921f81d7208e972cd8e6644dfc7cf18a18d65745d17c02307dcb26219", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798487, "uuid": "c3a71aa6-77b3-4544-a803-ac9c894dea7b", "value": "5005013E66244F4FD17C16FA01D1925016F0AF8AA20BF3763CD930EA15F6786276EB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798487, "uuid": "67411c94-a6a2-462d-b7a2-972f5c203742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798487, "uuid": "bff907a3-c5a2-4b63-8c51-4a3f99f21d3b", "value": "24576:YJJ6Y8u9vWu+HTmV8ZT6g5WpHa7u2H5W7VA8Nm:HYTlByUgu2ZKVA8Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617798487, "uuid": "55291acb-7184-42dd-aca6-b7dd05fca998", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617798487, "uuid": "7ce5475a-2609-4519-a3e0-f2628ef9eab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798487, "uuid": "093a94c3-d19e-427c-a856-2c2d8d08570d", "value": "PO_ATHCHEV0035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26a3a89-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824762, "uuid": "d2270f00-fa40-46f0-b684-d324975be26f", "comment": "Malware payload (Dridex)", "value": "36e6f5e874c88cc96b533dca1d6041b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824762, "uuid": "c9bc1608-1117-47d1-8c74-d50feb08cfce", "comment": "Malware payload (Dridex)", "value": "aadda8091b955ebd6bc1aad859d3f48acbd5e9dd3f59ef4a85aba83f32278071", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824762, "uuid": "e1809359-35e8-49a2-a620-c1cc35c04980", "comment": "Malware payload (Dridex)", "value": "b671fcae2cc74abde724e565357dab5610195bf1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824762, "uuid": "1306c43f-7063-4077-b4f4-3e12293998fe", "comment": "Malware payload (Dridex)", "value": "6754d1cdf6d331a96ed965ebbd712c700d2f74f399148260018a366e8b872cad9fbdddf31008da02da90d905a56ba1c4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824762, "uuid": "36bcd916-d66f-4343-b1b9-a6a87d30c0ba", "value": "F0249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824762, "uuid": "2868a5fb-865e-4672-87d9-1605e13838d5", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824762, "uuid": "222ef6bf-b233-439c-ba07-74df53980cf1", "value": "3072:m0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:lpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824762, "uuid": "138f1928-0056-487e-95dc-3dabc4e8d96b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824762, "uuid": "83cc8432-8421-493e-81a3-644ef6d0475a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824762, "uuid": "3995df4e-1c51-4615-8436-d41f4c4cd8c6", "value": "aadda8091b955ebd6bc1aad859d3f48acbd5e9dd3f59ef4a85aba83f32278071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de6e89-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774972, "uuid": "acc3734c-f7d1-4c84-a33a-350d84b48a3c", "comment": "Malware payload (Formbook)", "value": "bb527a1f4067af378c4e2dd898351d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774972, "uuid": "1b5ed852-094a-42fe-8026-f2e1b383682b", "comment": "Malware payload (Formbook)", "value": "ab0ee61d22f6d68b80ad6a2ae7a07f728fcace7382c585b8a19f2e8391581208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774972, "uuid": "cbdccc83-2dd9-4517-97fb-4a3ee2a166d7", "comment": "Malware payload (Formbook)", "value": "9ccba9b8208be2642322ece8ec93174eb5397a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774972, "uuid": "15bd7215-ef08-4648-8efd-690d0b5ffae9", "comment": "Malware payload (Formbook)", "value": "09f32131d43d79ae42d3e9b4a721b0b31fe04ba93bd007aa5a7e51f711699217ac0f584aee383d7f08a6047b720b1d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774972, "uuid": "e241f045-aa6d-4070-90f5-fc8a8ec92858", "value": "F5C3703EA264966ED8A804F789967C0466F3F45CB7E1422B0D7FC55720DAA430E1EF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774972, "uuid": "b67e563c-35d6-4981-9a66-2f38a01cf609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774972, "uuid": "d848105d-29dd-4950-8bec-ffaddc7e4ad3", "value": "384:pfHJtL9K330XVleP6xNT9Quoxf7GYUzHnEAn+slBCwrSzUtgq:VJ99K0jeS6fEzHnvMwr2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774972, "uuid": "1141eb32-62b0-4a11-a120-1eace23e38c3", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774972, "uuid": "8ea71a19-14c9-4af9-8f47-4581ccf72b80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774972, "uuid": "fc32f071-525a-40bf-b1f9-915e958a03bf", "value": "BL8846545545363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4e8775-97d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617821992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821992, "uuid": "ecf4efb7-c5a0-4b55-a6d9-74ac2bf0207a", "comment": "Malware payload (STRRAT)", "value": "0820fe7a5db15cc5cac299cd26e4c95d", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821992, "uuid": "0d43a153-3cc7-43fc-accc-3ec66742d05f", "comment": "Malware payload (STRRAT)", "value": "abda456f2f4994e4e619ecfe2ef5dd2e1a4fd6d4e3be8d27074052703362eb15", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821992, "uuid": "4592f2c0-bd1d-4b58-bc46-7e017a48e18c", "comment": "Malware payload (STRRAT)", "value": "40e266ee6285586405bb3a9d75193672bbac72a7", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821992, "uuid": "b10a66db-a022-46ce-bf65-5689e584e083", "comment": "Malware payload (STRRAT)", "value": "f9ecbe7490b42e7a82eda48a14685566a7f29e3986c777b81b96387ca8cf81910bc2b7e57d37f4656f885938fdebd78e", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821992, "uuid": "000cf024-4b8e-429e-9f8e-6ef29a5b2cdf", "value": "BC141206B8B6D565EBD602371F8BBBBBD51E42ED00328F2F08D21B947433546959E28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821992, "uuid": "943bfb12-8b3b-4ac3-8cc0-aec074622a16", "value": "3072:ZlRpFPn2CMV+3qMf2H8Np/coC9Ivr3YFVOgKeJaNovDE2wqWBAmm2CmvkmemptMq:Bn2hV+6cRcxwmceWgDUAmN7/Mru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821992, "uuid": "f348e0e1-0c56-424f-913e-8b23e4feab92", "value": 192506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821992, "uuid": "37541d49-4574-4c54-a208-0b85fc2b0ba0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821992, "uuid": "cd48bdd3-d5e1-4ed2-a62b-75d7ed68d1cc", "value": "DHL Paket.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f46423-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774727, "uuid": "8df5d36d-2622-48f1-b409-f7ac3db1feb1", "comment": "Malware payload (Formbook)", "value": "f42b7368faf66fa6c598c7d854783dce", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774727, "uuid": "89a85d46-cb91-4878-8d75-3fcc165c7e6f", "comment": "Malware payload (Formbook)", "value": "ad62423fa86a4bd84e4fc02dd4e49d463789e7b61f036c6b54c93be7956de930", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774727, "uuid": "a9963a3b-af8b-4fb8-ae82-9272f017958b", "comment": "Malware payload (Formbook)", "value": "7546538fd563ffea45027e1dc6cc725f0ea952d6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774727, "uuid": "689a3e72-25c6-47f5-96d2-2608531852eb", "comment": "Malware payload (Formbook)", "value": "906412cb3a568180908facdb7048ae22fdbe8a66caeacbb14d05fbf767e61f24e270b53c8d6e44f1675b0022c8e1023d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774727, "uuid": "13a44ac0-a776-4d21-9f51-f7960ba5f2f2", "value": "F2B423EA841B7FB3D55C64680A6FA5B01AFCE09121BB5308F5ABD09824B77CCB31954F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774727, "uuid": "b204607d-adfc-4e83-ac83-3e68503b1956", "value": "12288:MaryNJhiAlGg9q5YgJEHaGrulDFHfXLLB25ARnzKz7+vQDSpq8g83:/iZ9q5YgmHaGrUF/X8qR+zVDyq8g6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774727, "uuid": "7815ddf6-a289-469d-8b29-7f432b58bff4", "value": 529396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774727, "uuid": "e670e454-7363-4521-82d9-1a6262840805", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774727, "uuid": "58d97d5f-22cd-4cb2-9f05-1436590c5cdd", "value": "Certrificate Confirmation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad64829-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794551, "uuid": "7f105176-09b7-4246-b9af-e3d2bf8e076d", "comment": "Malware payload (Formbook)", "value": "1137a2a845b5489783ce5aae21303ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794551, "uuid": "ff0f8b52-d733-4e5a-aa0c-81530db0dd46", "comment": "Malware payload (Formbook)", "value": "ad8dd5f1c3a9021711415a43bfd680447dc89da919fc35faf76ded4e9eb79f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794551, "uuid": "feeeb179-b62b-4900-aa95-4eea52904983", "comment": "Malware payload (Formbook)", "value": "f648d91e22ce2e1d171cebd1a223debe59b0edb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794551, "uuid": "f45e350b-1ef4-4d11-982e-73ce4dcdaffd", "comment": "Malware payload (Formbook)", "value": "d49e6654b6d8b7e1b97bec06a40c27cbeadee85adc745c3370eef0ec8341fc8c9568fb3f00530ad20b1aafe7ffb85184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794551, "uuid": "e3e202d4-f6a9-4a92-aeb4-a9de98b8a7e8", "value": "D0F4691C2A9844F4D5E936F4082180411BADAD1F7792B709ABB0FD693A33633CE5DA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794551, "uuid": "d522e1cc-d258-4a7a-ba39-4548521d1fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794551, "uuid": "80b0ed3a-030f-464b-8930-4d35ccf61dbe", "value": "12288:GY+StSI483V27N246GUrO/9xgOJvLhSi+B2Plc+ei2RJMmaBMLUrly3bUVsu7i:GKtSIb3YcXmHbJzqBUl7BMLUraai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794551, "uuid": "65746d97-8abe-403e-89d8-7bcedecba00d", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794551, "uuid": "07be0985-f46a-4f2c-9be2-0b9b7d0034ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794551, "uuid": "5fa868dc-39a9-437b-ba87-199b78b687a2", "value": "pvUopSIi7C5Eklw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e192c3-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775248, "uuid": "28775cde-59f4-4c7b-bb22-1a5cf345619e", "comment": "Malware payload (SnakeKeylogger)", "value": "9f9be1d3de165cee006c320b57d656a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775248, "uuid": "171fe8b0-b435-4801-9d57-7ac24ede41eb", "comment": "Malware payload (SnakeKeylogger)", "value": "ae1efe48a48d407e61531703344339809994b4c1bc339cdd4e4f5a4ec9f498b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775248, "uuid": "e5ab35ff-dc77-476d-a474-75231dac4ef7", "comment": "Malware payload (SnakeKeylogger)", "value": "0cf2b325dfef969bb512b6905369a4b10f1f65f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775248, "uuid": "6b2120c2-c354-4b2a-8e2b-eb17be256deb", "comment": "Malware payload (SnakeKeylogger)", "value": "fbd648a8f9272ea1c0b29fd8c9e4a867a5e48b537ad7b28b5aced88cb73069d516f7be2b9d413cf98ccef021e1096b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775248, "uuid": "606c55c5-4560-4ae7-97e8-b980387a998f", "value": "7905E02233859F64F2BEA779A061423043F2BD47E376D64E7C9CB19D2971BC1C262762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775248, "uuid": "65e48c3a-6d7e-4002-a041-4abcb8f51d1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775248, "uuid": "4823f901-411d-4462-8595-2ca67c740974", "value": "12288:7mbRtRNC32DnLLeVIcvOgz4jTDdXsnrd/JbMeZOkPeTdazdh8qtLKaa+sopucy1:7mbRkGDnHxcmZjndchBM3kyaiNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775248, "uuid": "a303a18f-8139-42e0-994b-7aa79e369339", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775248, "uuid": "7e331b8e-0bc6-4b80-be48-4b7e610b3670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775248, "uuid": "a8cef418-6c65-41fb-9c95-fa6b824f0059", "value": "OVERVIEW .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92b23bd-979a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617797715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797715, "uuid": "e17ca465-ca13-4f4d-88e9-8cb6e8ec081b", "comment": "Malware payload", "value": "5907a87fb4ba6b0b93305398e3a6e88b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797715, "uuid": "dffe8068-3626-4dbf-98ee-c012c4e098a1", "comment": "Malware payload", "value": "ae3e5d5dcc3e4bb0db8cb46a224ea4950f35d24f0f9276ead8acf2e7217965ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797715, "uuid": "da87b068-3b48-4684-9762-5a0bc9b57c60", "comment": "Malware payload", "value": "ff34c3fc2fe6f3a1503505f1fb740b68b56840c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617797715, "uuid": "b6c8947e-64f8-45b6-9a04-d6f30e672620", "comment": "Malware payload", "value": "8a624da5d58a5661b30c62f5864bb6db6b43952ab42626425bfaeac7281fc5d000a8870b75431c0b758258fd97eb8aea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797715, "uuid": "3fe2c0e0-6e42-4622-8d27-f78551e82c12", "value": "C4F423C7791DA14B5245F88EEE60DAF781A28F7F06D4C6EA8726351FECEE0798445310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797715, "uuid": "873853a3-f911-4b4e-9fea-ba4e29c4fd95", "value": "12288:ZC9th5jpfctz+l7JaIwta9yybYYOgXUkuzJ5F3cSbgL+6FxGN2pIeUwZnQBq512V:u5FfcR+Nwta9LvzMvqYgLZ6N2GSv54rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617797715, "uuid": "5041c58a-6eca-4af7-b5a6-f3a787e72691", "value": 736001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617797715, "uuid": "60113aae-f5d3-414c-8a88-db9ff273037f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617797715, "uuid": "a32735a9-5d6d-4677-b72e-d043691250af", "value": "PAYMENT SWIFT COPY MT103.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449ee129-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617775105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775105, "uuid": "3f1b664c-2010-4cfa-8856-cb8355e636d1", "comment": "Malware payload (Formbook)", "value": "de58e733f0feac7c8d0f9b5dec828185", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775105, "uuid": "790efd42-49f1-46a8-bc80-9a5940582743", "comment": "Malware payload (Formbook)", "value": "ae544fc1c3293473d4261360fa739819decfe531c900f085e555fb4afaf15847", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775105, "uuid": "f28edb63-1be1-4c7f-8a9b-f4c49e352d83", "comment": "Malware payload (Formbook)", "value": "7ac342caec2eed7d7f85dd6604a30a56367573d9", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775105, "uuid": "aabe6206-19e2-45ab-a5bf-5926abd7e292", "comment": "Malware payload (Formbook)", "value": "55ac3620320eefef5031e0a372f995c745b868430ed5f82030aa6c5462274dca9f4ab6e9083e439970262d71599d2d71", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775105, "uuid": "4a5b2f41-3706-48aa-ae3e-e5d8131bedfe", "value": "63F433958337E95E3AEC87CA3E52CA5F975353B6C2C3580B2AA135AC774B53C3AC1105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775105, "uuid": "30e1c3dd-1c8e-4454-844c-5a060e6ca874", "value": "12288:xVMb03hkX/VKJGvfg2YWtE+t37DnwMmVW88eTcqDa7VJUtm11GRY/h5lnpeKzcZ:xVMb0RkXdSWo2Wk33nwMW8/qD8VJUtmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775105, "uuid": "fe5303f8-01b1-49b9-8ff6-438365cb5a62", "value": 782865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775105, "uuid": "dc0985af-0029-40e4-b2c6-343807d055d2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775105, "uuid": "df7f0452-9165-4d55-83f0-62431c98b9d2", "value": "\u0e23\u0e32\u0e22\u0e25\u0e30\u0e40\u0e2d\u0e35\u0e22\u0e14\u0e1a\u0e31\u0e15\u0e23\u0e40\u0e04\u0e23\u0e14\u0e34\u0e15.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d896abc6-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774924, "uuid": "228cd7b5-b587-40b2-8af6-4e682f2fbdde", "comment": "Malware payload", "value": "144ed9c7b681b58e6fb69a86aedbb859", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774924, "uuid": "4cff16d6-c9a0-42a7-b6ef-1dc8e2f7f90b", "comment": "Malware payload", "value": "af345ba105bdf6a7015248d032984f79afef8b19e700235578522d279322801b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774924, "uuid": "fbbdb05e-0a7e-4cc2-8d5d-06a39b786886", "comment": "Malware payload", "value": "094d7c3b632fff0120feb6854bfb38bc7dbb56f1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774924, "uuid": "3b7573ac-9ddb-41b5-804a-79cbea9f1163", "comment": "Malware payload", "value": "4777b598c0605c5b8044f0e6e5aef6db6e9e61522f945432144ae0b862af983e09d0ec96ec540da494d25966b6df3f97", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774924, "uuid": "1fde5c06-62dc-48a5-be9d-772de9b0827a", "value": "AD75332BE870F68E9C90A6D9B74D337C622D6C0846B998F08D16331975271DEAFD3271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774924, "uuid": "415d587b-8326-4155-a251-599a0dcdef04", "value": "49152:kk1l4iZdV5hnnZzbBhy0TzpNlnhAgg/aSnQN:kivZz+0rlnagKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774924, "uuid": "117cf250-13d5-4f10-870e-f449a6ca6edc", "value": 1618600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774924, "uuid": "dedc10b7-b74d-4783-a61c-85bb83b9ffdf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774924, "uuid": "ad49770c-bc97-4a8c-8503-a7a054129782", "value": "QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b54221b-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794444, "uuid": "7507576a-12cd-4e90-9465-a5c4c730e511", "comment": "Malware payload (AgentTesla)", "value": "d817da56a8c990965cc99e0180d7221a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794444, "uuid": "42b6840a-410d-4fcb-993c-ef33fc50604d", "comment": "Malware payload (AgentTesla)", "value": "af591893605b2f2c9e89e8e6752dd0b8ee8194362edba927513ecd43bac5c1e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794444, "uuid": "8f21b20b-f4fb-4604-98f8-ec53b7e3495b", "comment": "Malware payload (AgentTesla)", "value": "eb180807175f47ae2691e58623ba64b3741415f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794444, "uuid": "f137b6aa-e3c3-435b-8f0b-0362c3a5bbaf", "comment": "Malware payload (AgentTesla)", "value": "eea4fea4f372613cf28c65af8e039f1924944b48635655a41a3e42a0d82c20dfdce22eb577954ed3450e84e01fb340e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794444, "uuid": "1fc5edc1-fe87-4f0a-b396-78296f1ba050", "value": "8345ADD1EE86EB48D17953F4D05C811883F1EE4AA325DE493D8CB38C5571A8ECAE52F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794444, "uuid": "4fd605fc-736c-4b60-af87-a316ab826354", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794444, "uuid": "f0d0dbfc-6994-4031-be04-2db1f5a17031", "value": "24576:20bcVeMHDnrJP36dGApYa7E3l2rJky4MuWzxQiKUT:ktjnMd1pBE4rJn4MTFQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794444, "uuid": "6447f04b-d731-40e9-8236-901e82881fde", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794444, "uuid": "c010fd3c-1474-4d7c-b3b2-9d047dc62571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794444, "uuid": "b93ecf95-425c-4cc9-be6e-3e225380dcea", "value": "PO#90KY_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6518517e-974d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617764422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764422, "uuid": "7bc76bc7-cca4-466c-8dc1-d85676329267", "comment": "Malware payload (AgentTesla)", "value": "351a74b7c21d1046415a549b41ed9897", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764422, "uuid": "e854dadb-58f7-49d4-9359-bd0297c4870d", "comment": "Malware payload (AgentTesla)", "value": "b1be33e48f36baa381215b010a7f982cd3e9ff8c650d0c3cfcad8add33244a3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764422, "uuid": "304281fe-2b84-41bb-96c3-33571351986b", "comment": "Malware payload (AgentTesla)", "value": "ae5ab3ce92e1096ad908670624e196193dc3cc8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764422, "uuid": "29254854-6b70-4d2d-904e-a70c47d44a3f", "comment": "Malware payload (AgentTesla)", "value": "2582d23af4d7ee3615319a1def4c62b6b8da7add2326d6557a3743c7f135c1ee85c5b55b9a3476912f06ebaece4418f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764422, "uuid": "03f104f0-c9b4-466c-9225-52680e5bbe45", "value": "2CE423495F3BE8C251A94140DADBED41A92C45FD031B38EE96EA32F810D667BEDDE310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764422, "uuid": "0fb7f599-92a6-48ac-b840-a1410966cd87", "value": "12288:4719uDNeZw9BzNrVDoZkc792lhoNB0KvupUWDYOh4GcMfZE:471gDNSw9HruvwhWrvupU+4GcMBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617764422, "uuid": "f4029111-3c65-4a83-9670-7ed6005c5010", "value": 694560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617764422, "uuid": "fb0ad6fd-59a3-4565-b207-deff35b0bfb7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764422, "uuid": "bf751bb4-d090-45da-bea9-2f42b072f9f0", "value": "DHL Delivery Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6563f7e3-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774731, "uuid": "5aaf69d6-ed93-4283-a1b7-a0365298d487", "comment": "Malware payload", "value": "6c71cbaba924e6472a18f002d9f84cb8", "object_relation": "md5", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774731, "uuid": "71545a90-4c38-4d65-bedd-91f02149e368", "comment": "Malware payload", "value": "b1cbe8f45e1df356c8fab495500f1476298ffedce26cabe3b67a7e8f878f72c3", "object_relation": "sha256", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774731, "uuid": "d46850e0-ac8e-4572-bb23-db9747a8da93", "comment": "Malware payload", "value": "c5da22ed4ff3be45c9cdbf2ccacdb737cc193a67", "object_relation": "sha1", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774731, "uuid": "7a3cf707-fc77-4f21-9ec4-78d397271643", "comment": "Malware payload", "value": "8d44d4fa83b13aab8d92d271392b1b8bf84695e4afccfc905fb864d411c11530bb6876d6baf38955925298499839260c", "object_relation": "sha3-384", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Orange", "colour": "#736763", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774731, "uuid": "4925cb78-d830-4c2e-a953-1ea62d7154e8", "value": "63D2E30EF4418DF2CB6C026FE4A688C07A7788C8C8B9D01ADE6F7D1E79CD4905B19D66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774731, "uuid": "2418d6bf-ccad-4d6c-8c5b-a85e6f5d50c0", "value": "192:BPDSrH7fNAro1vaz0ai4xznySIiPki8Pi0UP+vFMWfUWx36J1b7ZEZasMDIOspnB:BrmH7fNArgWnDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774731, "uuid": "abfc8fcf-cb30-4795-be4e-0a8c4bc5a828", "value": 30608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774731, "uuid": "f3df8ad0-1fe2-412b-8429-b2019b37f734", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774731, "uuid": "04ac9636-446f-4918-a711-48c0b84ea5df", "value": "ID638927302.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95268e7f-97d1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617821197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821197, "uuid": "bce6500a-fb71-4f39-8b05-19c4130978ce", "comment": "Malware payload", "value": "1a37318157f52e5477fc6ce446a42f79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821197, "uuid": "88155a9e-d880-4cca-85f0-b343ef9aa1ae", "comment": "Malware payload", "value": "b223137961759aab259243f94f9961d6d98bdfef5dfe325ac6b1aabb822f7a68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821197, "uuid": "9b135aad-ab48-4ec4-87ca-1b11e1821a88", "comment": "Malware payload", "value": "e5cd2cde594eb77b4a0b437a187d4acc2ec65177", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821197, "uuid": "062a726e-79a1-4244-aaf9-ec127ed8e6b0", "comment": "Malware payload", "value": "4a44cc4563b0a83586fdca16b0b610904a3c677d7196bdbd2367cab250036665340ab2103fc65ef0a344c0e6b88bc7ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821197, "uuid": "36876a7f-4609-4c34-99d5-83d3deaebca9", "value": "DAF5232857F4601EF1F39730EAB14A5328317C16A9709D7E1AC5230C29B35A6EDF17AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821197, "uuid": "755f5806-69c9-497c-8226-94fcc7796f2d", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821197, "uuid": "542b7205-8052-4ebe-ad6a-5f404e4dbf97", "value": "49152:y1z/7bVuTpWUZ6wOCVMkqBSBmuQucS1nMp1aj4Wq0av9LURdeeIB8KYgnctJXt:C/7bVQYuMziMT6/ALYeeEtnWXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821197, "uuid": "c0771fb2-8065-49a6-a90a-55586306736d", "value": 3411056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821197, "uuid": "d20df32d-6a29-4921-be54-240b095cdb2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821197, "uuid": "861ac988-dd2f-4013-8e3a-c0b8b5bcf00d", "value": "avast_secure_browser_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1590e463-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775026, "uuid": "ccb83fd5-4eb7-4b7c-a04e-c9744ef6305c", "comment": "Malware payload (SnakeKeylogger)", "value": "35b9c2fb113b341da994a9eeeb65e920", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775026, "uuid": "becc3af3-f8f7-425d-ba8b-036751e062aa", "comment": "Malware payload (SnakeKeylogger)", "value": "b2886305c4aa1e643de11d41f285e4de2712801e20e5030a32c36c62f6f1f3d7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775026, "uuid": "bff2218b-7ce8-47dc-b375-d5b7c85278b8", "comment": "Malware payload (SnakeKeylogger)", "value": "21d50ab8485d685b511d678a53cd898cc6500f99", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775026, "uuid": "300be415-fbbc-4ff4-ac56-b95afb78f33d", "comment": "Malware payload (SnakeKeylogger)", "value": "0f82469fcb9007b3a774e9583629c36639cb3deea2ca146192182b5afc70b3f4b7dc62b0776c6b9e51ddfc8d863e33c4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775026, "uuid": "50999ecb-7378-4f98-b6b8-7ae495056456", "value": "0B25BE1272846B65E93EA775A030C53043F2BC5BE235D64D3CDD789F3A73AC28662762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775026, "uuid": "8664f885-c86b-4d24-8542-4f7dc88bb470", "value": "24576:E+tbtnEDn4hpxaFw/nbZTPEHi85TU4PjKyC6nK:jnenAaw/nlC5TU4DJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775026, "uuid": "9ea2eabd-71cf-4098-b668-f42610d8c72c", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775026, "uuid": "90f11385-fc82-4404-8006-ce4e6a5faa77", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775026, "uuid": "4f78b11a-d9c0-405c-9377-3404712bab3a", "value": "Confirmation_1422 DEKRA order,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26b3385-97d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823930, "uuid": "d3124a87-822f-4c0e-9199-471af46960ff", "comment": "Malware payload (Dridex)", "value": "3fda52051461f7ecd8d0fdc0958e4e2f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823930, "uuid": "b34e5aa3-6cfb-4cac-a437-0fb45dfaba34", "comment": "Malware payload (Dridex)", "value": "b3c9d068d9bec76ae3d4164b93b2a1d12057f2fad34002ee68832033bab9699d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823930, "uuid": "fd7e67f8-5dfd-4197-8bfb-da2836aa753a", "comment": "Malware payload (Dridex)", "value": "f0220affca75421ddb62227ad8a224d8d058a955", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823930, "uuid": "e1561f48-971f-495f-895d-7a4e944189fb", "comment": "Malware payload (Dridex)", "value": "2d4775a32e09b1f4fdb270dcd9abd245c1dd4cb1361cbf1427fe5366356e3a9cdd5619f31bfa108bc8721d1f1d2a714c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823930, "uuid": "b18d72e1-b04b-4631-87df-ae5dd18c435d", "value": "C8249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823930, "uuid": "a191a57c-befa-49fe-9874-7d449cb19f6e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823930, "uuid": "69536307-3bfa-42b2-84d0-b166b35993c4", "value": "3072:Q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:rpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823930, "uuid": "f3457cfe-f235-4817-b2fc-d92ca9b895dc", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823930, "uuid": "4a6370b7-8a10-43b9-b202-1c9b5320476d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823930, "uuid": "c7d57b99-89de-4f4d-95c6-7876c7de970f", "value": "b3c9d068d9bec76ae3d4164b93b2a1d12057f2fad34002ee68832033bab9699d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707d891-97b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617809147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809147, "uuid": "b46ce417-5fac-4c13-954c-e751027c40cb", "comment": "Malware payload (Formbook)", "value": "6ebcbf9650401abe10966f47a7d98d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809147, "uuid": "17541b07-d5df-408c-b71c-91054940a35d", "comment": "Malware payload (Formbook)", "value": "b49f6a646a9c6cdc0456310e02695f338b0a9fe352a7b8edbdd3ed8e1ffc069d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809147, "uuid": "3a4a54fa-4f0c-4a94-8219-7a67566bd9a0", "comment": "Malware payload (Formbook)", "value": "873f872c3035b3e06cfe8619cf3fd61ffd70dcf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617809147, "uuid": "e5b59a0a-e449-469a-a2a8-4d1c1f2743cb", "comment": "Malware payload (Formbook)", "value": "15f85c8e0ef2d1fbfbc4a9b6d83babe55668b2605bd0733156e0bd9ed53711ec5299b53f4d5e31558197e4e994ae00ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809147, "uuid": "b0a4b46a-6774-4654-8162-8287d9fe2260", "value": "526512102B9C8F80E47F5B360632645127F1BD6ED326D65D3DD932CE3AB6A448772B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809147, "uuid": "65be10b8-5a84-4fe9-89dd-2bb67dd48768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809147, "uuid": "305bec9c-ad9a-49ea-a6dd-cfe4e7968a2a", "value": "24576:p21sz+Txdx1t6gy7Gevo7Xf1iHqwMIQDB4tzL2P6gsfW1bdv/ineqc:p21sSLxf6B7Gk/6jDB4tzLGewvqne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617809147, "uuid": "9173a966-c8bb-4281-976e-956b7158ec07", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617809147, "uuid": "220c8364-7f08-4e49-9180-cd1dcafe8b2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617809147, "uuid": "a0f91e2f-6330-4e0c-878b-a1459fd70d4c", "value": "comprobante de pago bancario.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418d0488-976f-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617778966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778966, "uuid": "32e4a28c-3ba0-4b3c-882c-5e46730232ea", "comment": "Malware payload (njrat)", "value": "56a81864c4d0d04b1db03f5b2a590291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778966, "uuid": "3863b919-d703-4070-8d31-eaa931f65b93", "comment": "Malware payload (njrat)", "value": "b4c02a157e2f7654039f8192d7c2f94cfbe14bb42e261fc206106bbb125924d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778966, "uuid": "2801f2cc-c373-4223-b944-b06e29908643", "comment": "Malware payload (njrat)", "value": "44818d94af77ea9c9b5b64558e645745a73cbe27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778966, "uuid": "26cba658-161f-4495-bdb9-720f8efbfdcc", "comment": "Malware payload (njrat)", "value": "1733cf33c0a4eb7ac4fedec11a1d9f0196077503df76f1e4b3935fd8568f40f7f9e4ded1e035494f95393dee118ef0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778966, "uuid": "e0f01d9c-1739-404e-adae-94f6a77dc290", "value": "FF63194E67D44D18E2BD5BBB48B2B20503B0F9476D03D78E0EE291892F3BB52CD85693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778966, "uuid": "cad8a19e-0423-4ab0-81c9-d3cbe16156a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778966, "uuid": "ebdb4203-5baa-4d98-a1c5-357003651d48", "value": "768:im47KHbqsDO7krnRZ7gzHTo0xmBi7LqWrgsasKcOvt9t9cFKpBB0Z0Daulde:xbqzgjyzoDBi/qW0dsw/tekpBBbde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617778966, "uuid": "9bbe5d16-4f21-49ae-90c2-17f75dd8f82a", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617778966, "uuid": "d6a52f50-8227-477e-883d-112bc2384e21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778966, "uuid": "42cd765c-857f-4095-83f8-1490c63c05ef", "value": "tmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337159f9-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1617772500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772500, "uuid": "282685e4-ab87-4d33-a2a7-4cc43f119f56", "comment": "Malware payload (RevCodeRAT)", "value": "f7d79ec6a3bf524f8f0c0e8d54949948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772500, "uuid": "92798f0b-182e-4f02-b2d7-606ea58710e3", "comment": "Malware payload (RevCodeRAT)", "value": "b4fbe906439597a3d05b94f3a7001069687e598cabc9a82e47d6c43046be10a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772500, "uuid": "f3119400-2327-4ecf-b858-6b85fb215dbf", "comment": "Malware payload (RevCodeRAT)", "value": "ff9535613f977f6321a1eca20c50e97d23c83259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772500, "uuid": "bb54bee3-6d15-4243-846b-df7273c1cbff", "comment": "Malware payload (RevCodeRAT)", "value": "2fa56a2565a798930ba480e489169c48761c4d56aaa29afb767b7315d8bbea8fe27ae5b7cfdee7b8896945b76b4ab59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772500, "uuid": "c9fc444f-0e24-4a3f-90e6-c068b8f1cf83", "value": "A07512223245DF4AE03953F40531916047F3BE52FA32D22E7EB4395EE6F2A46CD61B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772500, "uuid": "3cdb546f-7973-4858-aa95-d09e7aefc0e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772500, "uuid": "b3ef9761-ec31-49a2-8548-da3ce7f75a9e", "value": "24576:0mGvjB51sSNvDZwEap6P47H4WN254RAebqWZstqhrpHTbXeUfOu82:KjTtwEWzRz6ebqMr9nu0Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772500, "uuid": "b0a13557-f81d-4959-9ef3-4efc77c284ff", "value": 1578496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772500, "uuid": "0c9fabef-4413-4351-8a22-13bc6d4f11e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772500, "uuid": "1f8cc15f-207a-4a23-a050-2c809442db6c", "value": "JANUARY OVERDUE INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6759908-97ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1617832822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617832822, "uuid": "ae269e1e-44ef-4c22-ab2a-da6eb3a7b1a1", "comment": "Malware payload (Stop)", "value": "8dd0fb4509ccb705c726ddd632aa94bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617832822, "uuid": "5454e60b-5c21-48f4-9132-80adf1b08f88", "comment": "Malware payload (Stop)", "value": "b526a2e743700e05396f10f6b2e9f1b1a8a74670a7b6969cf4471bdb25a77802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617832822, "uuid": "c634cd3a-ba9c-45e6-ad41-50555a1d17e1", "comment": "Malware payload (Stop)", "value": "7246997b21a46f39c506b72fa60c4a92a3a71471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617832822, "uuid": "b521cd5f-aec8-455d-94ed-348a407ed63a", "comment": "Malware payload (Stop)", "value": "cd96f22e34b350ee4d58387a1b3eea507899e516927b12ac152a4645cd35227d20fb720dc41b852d90171ac9fd5a1be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617832822, "uuid": "eee2f18e-fae3-44f3-88b6-758f61fbdc86", "value": "0405010132D0C132D0D625764525C7B14EBBB4725AB69ACFBBC82F7A2F252D1E631B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617832822, "uuid": "39664f1e-d8b1-4211-9a93-0926818ecffb", "value": "de005d8006d366757b6944ed8ee69929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617832822, "uuid": "724c60e1-ae40-41af-8a6d-713ad5e7cec9", "value": "24576:rd4vRW9MUs0DFBmdxA+6Xq5qzbXzuqaZMg6CWK45:WvRW9MI3Ci+60WbXPaZMg6C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617832822, "uuid": "18eac5c0-d37e-43b8-9793-0546da315099", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617832822, "uuid": "d6a45e16-2518-4df6-b7cb-073873208fd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617832822, "uuid": "e5b213c4-6b8f-4729-8708-72bb279249b0", "value": "8dd0fb4509ccb705c726ddd632aa94bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9370282a-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617774808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774808, "uuid": "0aea7964-0abe-46a5-ac73-76b1add1c7eb", "comment": "Malware payload (SnakeKeylogger)", "value": "8eb6aac1cdfe44c13112b0c09e8d1f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774808, "uuid": "e97d167d-4bef-4403-9776-1efddac5e0a0", "comment": "Malware payload (SnakeKeylogger)", "value": "b6310419622c8cb61a0511e47d56c1a0ceea5483880c1145ccf3f2d72d88d6b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774808, "uuid": "661f9c04-bbd4-495d-8b58-016325bb331e", "comment": "Malware payload (SnakeKeylogger)", "value": "ff3900542ecce4bdaa4cfcc9e44328aa792321ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774808, "uuid": "abc39986-8013-4c6d-a4d0-79ffab347d2c", "comment": "Malware payload (SnakeKeylogger)", "value": "f879725103c53ee1e880553c263269af1726e314354657a8ff1b75c4a45a81ac84d8c42d6a7b5317bf76e5601674873d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774808, "uuid": "42d08abb-9fe6-4f26-9d5d-9c53e4053f69", "value": "4ED4CE152E9945C4E8EE37F05821800107BEAD2637D2F719EFB476696A32633CE50B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774808, "uuid": "9e149e2e-25d6-4765-8ad2-ebbb28029eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774808, "uuid": "b04834b3-13aa-4c2d-8fd8-425d5ad7ab32", "value": "12288:5M1sb5ZCsR5Ai+lkhlkQPLhTKowCz2gNfvYaQwKi:5Pb5ZCAIkhSQThTl3YJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774808, "uuid": "a8497898-2a5d-437f-9119-2f78586021b8", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774808, "uuid": "832d946d-26ac-4546-8fe7-397734d57163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774808, "uuid": "3ff70322-5eb3-4680-8155-91670924bf0a", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bf7ffb-97af-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617806412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806412, "uuid": "60c73163-f2e0-480f-b443-0f2e53ed2f59", "comment": "Malware payload (AgentTesla)", "value": "f1e562cd2288a33b2d446df015d64916", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806412, "uuid": "7ecc4418-df39-44d9-a106-25320eb4bb66", "comment": "Malware payload (AgentTesla)", "value": "b68f9419a52a690f1572c9d38e3311ec2ef9007935354e1122bff14c41b7e9b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806412, "uuid": "821cf9d5-9b58-4fa7-a7e2-05772b0aa54d", "comment": "Malware payload (AgentTesla)", "value": "1f0f895ae78274c4add3be2800ca46339a12862a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806412, "uuid": "8e174f04-07ba-4b45-a479-cb15fd1f9fe4", "comment": "Malware payload (AgentTesla)", "value": "184fb796c1a3ceb7eb3ffc98f28c31068ed4450f922940f3338a0f5b0bb0963c1a8db278326528ccae0bb6e9ad1573f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806412, "uuid": "b7900d66-4b37-45f3-8900-c0d95b388295", "value": "2F1501716294171AE87ED775902500100BF7B90AE336FB6D7CAC528D1A62B43EB33B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806412, "uuid": "b5851ee7-6f26-4728-926d-06ad6f9b42f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806412, "uuid": "1d2a2013-9fe9-4c4b-b779-c622a4c67f53", "value": "24576:5hbNkJSDTW+XbaRI0/w4RQxPVc4Q0QcedRtDcVYr:LxkJSDTbXWRIavKzc40cedRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617806412, "uuid": "f7d00ef5-0513-4550-929f-49104bc48749", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617806412, "uuid": "1cd07193-6d34-4d19-a380-5a892dd7a808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806412, "uuid": "16805b8d-37c3-4033-afd9-05bae94652f7", "value": "one new parcel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8ad56b-9792-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617793959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793959, "uuid": "d6b18b72-753a-4ee2-b6b6-d1a7c142a95f", "comment": "Malware payload (AgentTesla)", "value": "3f5abfd2c776f9e863553c024d207b3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793959, "uuid": "71d79b1b-d70b-48b6-8bfb-27217b2d77d5", "comment": "Malware payload (AgentTesla)", "value": "b78a76ff52dd90cc1b89400b9404f2f1fe973c62796fc049ebdb83348239ecde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793959, "uuid": "ec3eb726-c50c-459a-b3bc-b4f47d608488", "comment": "Malware payload (AgentTesla)", "value": "b340ac80320cf5dc8a6e1805742e82c6f6a4d141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793959, "uuid": "58b40c13-3a37-4714-9b92-d6fc25a8a797", "comment": "Malware payload (AgentTesla)", "value": "7e91927af6d2bc594f9757d3a5264bf66799d7afe7f7cdb6c02514fc86b1ded64a59d389ba9649afa1009d1a6b94fa5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793959, "uuid": "f9bab78c-bffb-4281-a576-3c4c00e5ffd9", "value": "39D4BFB875047DD62A7F176BDA96ADDC13B626328ACBA4CD80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793959, "uuid": "bf02ecdb-da82-4d3f-9c1b-cca9220d38b4", "value": "12288:fr0gCnwPyPAqAiNmh/sVl1tzkBs2eqa+1IaPNPgbsr1Ni2Sz:frpCnwaPAqDNmebGBsQa+6aZgqkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793959, "uuid": "db067de7-3303-4196-afec-a9afdac17266", "value": 646376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793959, "uuid": "9f3e660c-5986-42ea-9027-f1c9d17323e6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793959, "uuid": "12ffeb21-95bc-43f8-b16d-867fdfa3a055", "value": "RFQ 4917 21-006-AA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c473150-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774716, "uuid": "8f2fe7a6-e4ab-4c45-bbd4-a5eec7e68bd5", "comment": "Malware payload", "value": "70017153fddcaf5bb6f68ae545a95973", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774716, "uuid": "36971477-5b1d-497e-96a2-9e2e39be371f", "comment": "Malware payload", "value": "b7cfb06c8ddec3b77ec05893e016446879c727a5a66b3125b36a565ee8f90039", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774716, "uuid": "7d1f459d-e80b-4d30-b397-ad6f8190c177", "comment": "Malware payload", "value": "23f3e60d27fb1b0788e9a87ea3a296233f9de3ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774716, "uuid": "9c473040-b0be-4da0-95d7-1d514803ff76", "comment": "Malware payload", "value": "af48dd7f8ff0ec76deb5d34d149d9ec8c0c6b291f310a28e9245ee0218a7b396dce8af59446fa8bf1b60688dc4debad9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774716, "uuid": "6c12c82e-d41e-4a65-8caa-8b51f2b3b694", "value": "3D0413D1BB978501D840AB3DCBE991B89D73AB07414142F96778D85538326BC3FCB92E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774716, "uuid": "9bec0e9a-fafa-4a93-992d-22396dc38dfd", "value": "3072:Wl9Fi0ztcP1fleFg61oXnr4CbdlFYOASF6TY80RHszmEm/QPi1Sg335GyKwu8c:6Fi0zG1g1oXnvbS1480RHszpWci17bpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774716, "uuid": "ff878a12-5c36-436d-8089-efbe658e0f89", "value": 178117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774716, "uuid": "120396cb-2976-4875-8d7d-b3e850901431", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774716, "uuid": "287cd840-ef3b-4478-9ddb-3eb4479b4e25", "value": "Doc07042021SFUSA.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a0e958-97c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617816936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617816936, "uuid": "64d24f21-a4fa-4764-a577-bd93400c7409", "comment": "Malware payload (IcedID)", "value": "199226a0a8ddf2138dcbc42e308269b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617816936, "uuid": "1495ac47-b837-4056-99e2-b210859f6cb9", "comment": "Malware payload (IcedID)", "value": "b84d2cca3a9b3a18192b5ef3a20e84790b2408bb107ac8cd8066f675e5406dd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617816936, "uuid": "743b9ed7-8b1b-4aaa-9e1b-b8a1100f5455", "comment": "Malware payload (IcedID)", "value": "c3c4e350fec338625cca7324b7c137e74c289f24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617816936, "uuid": "23f4f8d1-1821-4514-8aa3-ad8e7ac8f30d", "comment": "Malware payload (IcedID)", "value": "601142ebcb8ffe6948edb87e0b313b7b764f6286f6ccc00b08a9954dd7a33cc57c81d7dfd7134efa3bdf84e6831462c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617816936, "uuid": "37923480-8626-438e-83e6-1d05c5bbb75b", "value": "6A24D786D4EEA6D3DA7E997570C5017975403AA0025CEFFBD2740B0693B37E29C1B32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617816936, "uuid": "943259d9-6665-4702-840a-9e96919524cb", "value": "28b031d0558b8e7db218ee60c7804970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617816936, "uuid": "13d5af8c-c0c6-4552-814d-d3f376ad7630", "value": "1536:cBM/AfZFMXHK19lTiZVs1mtBNBCW9v0xkOY/YwV/mxMy5wTRB6SdosTrfw53AJoj:cBM/AfZuXuZWx09Y/ElDpYrWXDNjt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617816936, "uuid": "d958a9b5-b195-43d2-b8a1-90a759120266", "value": 225294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617816936, "uuid": "e2757cc3-5d5e-43b5-97b5-382758873db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617816936, "uuid": "9e3642f2-e878-4acc-ab0a-dc734ee1d0f2", "value": "199226a0a8ddf2138dcbc42e308269b8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e113eeae-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617772791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772791, "uuid": "a53eb09b-b60d-4402-b9d7-08c41bf0811a", "comment": "Malware payload (AgentTesla)", "value": "56501ee7dfddb130e455a5cd952994e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772791, "uuid": "00f1260a-62fc-47a9-9ba2-d4930657070b", "comment": "Malware payload (AgentTesla)", "value": "b90fb49ced2711300981110e8d872b5b2848ea3449ef2db157df053dc6fe49c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772791, "uuid": "4ce46f3d-223c-4dd9-a118-8d4f42a702e3", "comment": "Malware payload (AgentTesla)", "value": "4770585ad135009ace3f2def9cc8bebb7efd4f7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772791, "uuid": "46175ebd-d1c2-4374-a683-a700fc416cd4", "comment": "Malware payload (AgentTesla)", "value": "d34b8f5777c7cf233a8b1fc4fd809165a27616e728382f2d7c3b436a7ee72d566754ae336e2a7998af9449d3c54db20d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772791, "uuid": "cb550556-788c-4fcc-b73a-87477449e528", "value": "0C15BD222EC96FE4F17E7735DC60702053F1ADD7A226FE497CB8B0881575A83827265E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772791, "uuid": "d63e92df-aa09-49a3-92de-e342b108cf2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772791, "uuid": "ee78f63c-b5db-4833-8905-38e2eb20df31", "value": "24576:OgbMjVDnQBKNFWIenl6Xr3w8+AK6TgBROMQ:wjlnQoFW1PFAKKgGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772791, "uuid": "979869c6-5f98-4173-a0be-41e88b72e03b", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772791, "uuid": "79328fea-0a9c-4af4-afd8-75c643f7e538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772791, "uuid": "2d167709-eb34-4e31-9bf5-7d837e94f562", "value": "SG1_000000123205044_1.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05faafb5-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775000, "uuid": "8ecd9f1a-c708-48ba-9814-1aa930d35aa4", "comment": "Malware payload (AgentTesla)", "value": "59e17c62511471df95e2faad79e1bdee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775000, "uuid": "8660e872-5100-4d73-826d-47a67f9ba41d", "comment": "Malware payload (AgentTesla)", "value": "ba9401e8bca51c8ba497abf551f24a0aca86ad96facde44a8121ef6d178f0ac4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775000, "uuid": "bc180e77-47bf-4cf1-8f78-3967f5d14bbb", "comment": "Malware payload (AgentTesla)", "value": "db1e3440226c1c9a25ff0d33caadd67e84139080", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775000, "uuid": "227f2725-c56c-417c-b590-8bdccaf0b673", "comment": "Malware payload (AgentTesla)", "value": "c60b2b44f21098ddbe33093abd0ad797192d0676046c17dee4c494d2e689ac7eec9adefe7a5ed50d122b2416ff3c79a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775000, "uuid": "8a9e0a76-22e5-42fb-98ef-e6529a09b1a7", "value": "A3D4F13E7B902E99C7085E33092749D826F492077136E33F78CD1BC54E1652ED72AAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775000, "uuid": "2a80166e-7322-413a-973a-c831792dc0cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775000, "uuid": "45f5b84e-1dbf-4d79-9e57-6c15e3bcf3cf", "value": "12288:RMpIV1Fn6OAVo1TAnk4VnBOytlnuiTSwsDIUWb:j65o1UB91DNUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775000, "uuid": "0887c576-e92c-43af-b219-a6dc1a777cd0", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775000, "uuid": "707abf35-c036-4e10-9d4d-db4797f40bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775000, "uuid": "6d47b826-1caf-4d6a-ad2c-44d73c429192", "value": "RFQ#040820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ad047a-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794466, "uuid": "320bdc62-f7b2-477a-86aa-bffc69c90ddf", "comment": "Malware payload (AgentTesla)", "value": "414a2c370bb5be299a89612fecf3080e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794466, "uuid": "4ebecce6-5b8e-4ee2-94c2-a43c2ba56344", "comment": "Malware payload (AgentTesla)", "value": "bac4593bad16d5fec61e1b28086efe980193bcddd217ba5e18140699e3b8079a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794466, "uuid": "7b328338-1143-46ae-b908-4e5b17d6cd2f", "comment": "Malware payload (AgentTesla)", "value": "3951390aed247da8f315361d08bc193d015cf455", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794466, "uuid": "219bad87-09fd-4a70-afec-40c4d00011fc", "comment": "Malware payload (AgentTesla)", "value": "34f0460b0db3cdb0e564c7af682b05d76eb5cca335fd0eb4ec63c1730d7e2335ed3910dd20560ecdaec02defd23a20af", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794466, "uuid": "3d8e512f-4674-45f8-b4eb-4f33e384b0a9", "value": "03F423D2B9D39626226285B095CD378B43644AF2896B3BF4A604C5437CE738D0EB5FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794466, "uuid": "53247092-810c-457a-8266-f851801afe50", "value": "12288:OEsBNJOMOnvWpInCe8DKXyAltk9Vrz0ne/3jC1Cdh5MBI//Loox36Z5CN5g9iQLs:A4xvIIC/DKGcne/T0bwX6CN5g9iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794466, "uuid": "a4c2ac6b-821a-406b-9125-b45175110fb6", "value": 738123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794466, "uuid": "b3a2d628-2271-4279-9966-35628703458c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794466, "uuid": "bbea7110-365d-49ea-9870-1970eff90eda", "value": "Invitation for Tender RFQCSDOK202140890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c5e83e-974e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617764764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764764, "uuid": "cfe7f888-638e-4e26-bff2-d45afef0c292", "comment": "Malware payload (AgentTesla)", "value": "423db624bb1be275a6a965c00343aa25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764764, "uuid": "d2ada7a4-db71-4e53-a515-b0c5c959b080", "comment": "Malware payload (AgentTesla)", "value": "bae26fce62c8cd3d4059bd66fae8f4e6d3c664ef1c259b118519ae3c8cb8eeba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764764, "uuid": "bffc37ee-169e-47b8-8603-0cbb4604d92d", "comment": "Malware payload (AgentTesla)", "value": "e9ace713ab91787638a875a72ed8ebd671012bf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764764, "uuid": "1262eb85-d418-4944-a619-e6b027e23518", "comment": "Malware payload (AgentTesla)", "value": "643c8c4fe933724266083ec20833f1c655111de32d7f8e59f50c4301e3ea99c34a730df1aef98964fe657b809d2dcd91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764764, "uuid": "7e9a63ac-842d-4d45-9257-a4fa90cb7380", "value": "E8F4CFAC3250B5DEC827C972CAA81C25EA61F1FA571B87539017029D990DA9FCFD48F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764764, "uuid": "193281c0-3e30-4e9d-ab2b-5233bab9765d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764764, "uuid": "1f406136-d9af-43b2-bb0b-d049003c8242", "value": "12288:AXlbdw6K2iNSHAoU3uJa8r11aXWwMzNWpa9LsuZj1SMyWT+6tg1cC4iUIVTRxdvN:Wlbyl1AHI3uz11xRmaLZjwMyWXg1cC4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617764764, "uuid": "9b5f7381-3423-4535-8a61-252b51ef0033", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617764764, "uuid": "479d4cf6-b676-4c6e-a16e-9a1df0388fed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764764, "uuid": "01c1ecf5-843f-471e-ab95-f2c734fe0452", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97157172-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774814, "uuid": "92c9e588-08cb-46af-8ffa-17ba5cb9ea2e", "comment": "Malware payload (Formbook)", "value": "f5565825294627e3d51d6852a3b52cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774814, "uuid": "bbd57080-34e6-484c-a056-fae34f044cc7", "comment": "Malware payload (Formbook)", "value": "bb41f3d7cd89e23050aaf19a29486c0725a3e3b15af1d638e556aa245b04955e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774814, "uuid": "19c861e2-e497-4f16-a374-fda84c1a6ca7", "comment": "Malware payload (Formbook)", "value": "d06b0e0a2763edfbf818043afd64aada6bf1be83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774814, "uuid": "55d961da-add3-4ce6-8056-1062693affa6", "comment": "Malware payload (Formbook)", "value": "af4322dfe25dd81a17b322e4448b5c93d6bad93b021d544325a750550493e101c3a2f390cc14e670775ff7370dae5157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774814, "uuid": "f7e767f6-9a0b-40dd-a0e5-738b44476319", "value": "3CD4DF105E9905C8E9ED37F11862814107BDAD267BD2F31CEBB479694A72633CE20B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774814, "uuid": "0aa320e5-a123-4db4-be0f-6e191665d13b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774814, "uuid": "d805e01a-927f-4593-bb55-e160d2768a47", "value": "12288:AJuA59dnQd2O0wxAUK36vBrrLaPFzJ4YhgyweUj2Y7:Aj59d3lBUK3mLaP46Mjl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774814, "uuid": "daf885cc-4200-4c0a-8542-a4d22928cac3", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774814, "uuid": "c40ef888-6062-4560-ac77-282b7b41a35f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774814, "uuid": "9450eb8f-e8fe-4285-9cbd-ede312492b3f", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4644dd0d-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794435, "uuid": "468faa42-a430-49e3-b6be-0573a3c8904a", "comment": "Malware payload (AgentTesla)", "value": "a21eb66c4c4920d28d0b732a93dd2a2b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794435, "uuid": "ddb7f89c-29c2-4290-bd3c-1be4b65c0fcb", "comment": "Malware payload (AgentTesla)", "value": "bbed3a1255c8d6f565a81e6ae5ccc95f196f427c4fe5629d1583eaa577ad5acc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794435, "uuid": "16a940d5-e78f-4aba-9e38-73690c6dbae2", "comment": "Malware payload (AgentTesla)", "value": "1d3c27b60b09aa92a0e102b06e14a2b859f56eb4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794435, "uuid": "e2f9703d-1a50-4602-af06-4a25d8e60625", "comment": "Malware payload (AgentTesla)", "value": "7d6b3b7349874e691048a0790c69b260903167d3bc33c60730324b14e6ac24d5b543145d89ad0c75f1e19d03566a66cf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794435, "uuid": "353792c8-8869-4d8b-b7e6-53c0dafff6d0", "value": "0FF43377CE368B708D48825647DBB4BC6476BA138B42E15F1F970AF019B40C76C6A1EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794435, "uuid": "73f60bdf-f591-4d0b-b04a-e95774cd37a1", "value": "24576:W8Vl5o0Nc05uZx/bQcCn6qtjmuoPn68uNl6g:W8Vl5o0NcCod/Mmr/68wcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794435, "uuid": "a7b1f31b-91b2-4d70-bf85-728ce13c0f03", "value": 792728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794435, "uuid": "a9e99e2c-3ae1-489d-a2f0-31bf2f83e4e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794435, "uuid": "d9894160-ee51-4a33-a4d9-0a6f67e886f5", "value": "RFQCSDOK202140890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19db4622-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617775034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775034, "uuid": "6c1b3d54-37b9-4d7e-b6f0-0c543f4dd321", "comment": "Malware payload", "value": "b959eabe96f70d03a2d285d7bf0aabbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775034, "uuid": "33e61993-16e2-4259-806e-9a75e33d7537", "comment": "Malware payload", "value": "bc450655867fc412ecbccc76323235ad9572e56675ded0a8dc6986ab09c8d9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775034, "uuid": "2a580857-fe68-42a8-ab49-b72488e3e5fc", "comment": "Malware payload", "value": "077206fc131473efd4f1001fd5a0e79aed0b171d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775034, "uuid": "0b4ad2d9-cf0a-4e6f-8575-68bafdeed969", "comment": "Malware payload", "value": "5eb0487415327dfd895ee3f62850829b01518d41d392bce8d4f4fc0091f68d2f85f15ee4549e9e4a1e8be353d49c14b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775034, "uuid": "e5afc722-95dd-4e2c-9351-a088da895f16", "value": "D6A3E79C766072DFC867D8768EA92C68EA50787B831B8203905716EDDE0D99BCF150F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775034, "uuid": "681d6715-7e37-4b38-93ab-7dfeb40d92c9", "value": "1536:wc2pgoONvAF2aKWt2jnyZUms/D29HM/ffYaj7WWi4WdNucPLug2ugkbVA:P2goOhaKWt2eZFBMnfY0ADP2ugkbVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775034, "uuid": "76665698-a41a-4e3c-a8cf-d9c4dd43b980", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775034, "uuid": "5de9c814-c4cc-41f9-a4b7-8fbbe665bca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775034, "uuid": "8db99a1e-8a93-45c1-b363-866c29cac78a", "value": "swift copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a25666d-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775195, "uuid": "fbcf242c-9c0d-4991-96de-c96a1dd6f6a5", "comment": "Malware payload (AgentTesla)", "value": "c4493e8cbd3c6718b4012ac630724c35", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775195, "uuid": "b1866226-c4c1-46b4-814c-82722d5c4c41", "comment": "Malware payload (AgentTesla)", "value": "bc53bbf6cd255b5bf3b06b5234fb1c733e1fbbc022828e20805fb89ea451e666", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775195, "uuid": "bc8817b7-3e08-4f67-82ed-49d3ccbcad19", "comment": "Malware payload (AgentTesla)", "value": "ff35d0579df82ba7611d42160e5c442c18d08e2c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775195, "uuid": "fbc6d5a0-b75a-427d-a002-10884afd7fd7", "comment": "Malware payload (AgentTesla)", "value": "af2dcbad67cef12d74231810334acc46f8266b16980014cb9d93913da4633b295575a43426984b0b813cc9b9f37b9f1f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775195, "uuid": "c5ba4bd5-9427-427a-b4f8-ffffe95e97b9", "value": "8ED4236F7FA555903CECDAE7D80A8A2F40457C6B72B222E3AB18338E759C5D4517ACC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775195, "uuid": "0e37b763-17fa-4ddf-94dc-c02eb154eb48", "value": "12288:Cln0lDj43f39r9oroj/XI5bwZhCV7nOBXRqtPRbNGArJjpavNEMinLMVI1GpG:t6f9r9lzAwZhUODApbDtUNEMMMVI1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775195, "uuid": "91e34c83-3c4c-4306-8856-69c539e47a79", "value": 639533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775195, "uuid": "54ca1593-2e17-4291-a51f-cce585d52489", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775195, "uuid": "e3a6ea01-5dfb-46e3-8f54-b75c55dac729", "value": "Outstanding invoices.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee11af0a-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617794717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794717, "uuid": "17872355-5164-46ec-a7e4-ea23b446c15b", "comment": "Malware payload (njrat)", "value": "bccb174e69ed40ef353a1a80b68ad7a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794717, "uuid": "177bc78e-af95-499e-97c5-22d76dab76a6", "comment": "Malware payload (njrat)", "value": "bcc2ea60410ac0611ddb3b6fe3be3006ef39793d1f4b084ef582082da8c26531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794717, "uuid": "81bf3d7f-1ef9-44df-832f-33255b1d9363", "comment": "Malware payload (njrat)", "value": "b8e0943130d2189c09f105d48051ee7bc29afdb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794717, "uuid": "6b9dc686-1998-4f99-a2a1-758c3b083e28", "comment": "Malware payload (njrat)", "value": "5706f9a233afd3c9e3bd118d94dd16096b4466e39663b9f790e8500107adbfc3793d258b4ebdd2eb438a3d489a0d4b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794717, "uuid": "c2e94e8c-5193-4199-b3db-680e0126b7ad", "value": "A0F3125BD3F800A5F132D17DBCB131D62285F43AD9D6C6AE4B5DB00B9EA84600B96B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794717, "uuid": "17c0192a-7117-4c8e-9494-9eb7891a0f56", "value": "6bac3cfe8acb6c6c4a30aaa022de2388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794717, "uuid": "3dab6ea3-d07f-4365-a546-ad171dd8e024", "value": "3072:Rf/J2ULiTehI8FrkZqIueBacKMXBZP4kQYgTOr33ioSex8bGV8Q:r2UL2i9FGat4rQU33QhEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794717, "uuid": "85e3d3c3-21f2-47aa-a83e-aab681fc495a", "value": 157538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794717, "uuid": "02282d80-dab8-42ed-9b53-9df6feacddba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794717, "uuid": "b7241e4b-b402-483d-ad12-46654fb89bed", "value": "BCCB174E69ED40EF353A1A80B68AD7A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af501483-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774855, "uuid": "f7c9db8f-584b-4006-a620-1ff483defcbc", "comment": "Malware payload (Formbook)", "value": "dbb02607b56bb87a9c1c511fb5b0b0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774855, "uuid": "58c8cfd3-9141-4bcb-9be7-b322f958f3e9", "comment": "Malware payload (Formbook)", "value": "bd6055810a703f4f0caec388c7cce89661ee9451179dc3abe6261480bda4105e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774855, "uuid": "09db525d-e55e-4ab5-9c9a-e93df4f10832", "comment": "Malware payload (Formbook)", "value": "df99e5833e8604829652ef62510d69485a3d132b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774855, "uuid": "dabf74ce-5058-4b5a-878d-969dd5580de5", "comment": "Malware payload (Formbook)", "value": "27a83e3d166b4894bb5f21116a1222545f01f1077d04ba0a0ef5f9557b1a04e4a2720b4def0fcd7744a8f0dd687cddc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774855, "uuid": "24b38030-80a6-4bc6-9a16-056bb9b5b4fb", "value": "D2845B823184DCDAE44329F248AFD57061786D9E8165CA0E3743BF2BA5E7353249F78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774855, "uuid": "d86fe0ff-39cc-4575-814d-1094d5bb9497", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774855, "uuid": "b8e7e9da-03ff-4cde-9d1e-1c7544115fe7", "value": "6144:dDIdstvLGtELbMUTKZp3+3lb8I80AEdbCdin9jh:KSityjKb+398T07MQjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774855, "uuid": "79f542eb-bd94-44dd-9991-6f44e7cc21d9", "value": 397210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774855, "uuid": "81171863-dc84-47e7-a612-3334da910082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774855, "uuid": "57feb887-642c-4edd-bcb2-01f6e8427074", "value": "RFQ_AP65425652_032421 v\u00e1\u00ba\u00a5n \u00c4\u2018\u00e1\u00bb ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b068a05-97d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617821153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821153, "uuid": "57663143-24db-47fb-a197-ab406855e4b5", "comment": "Malware payload (Dridex)", "value": "7307fe31f0710e1566a1d82c915d4905", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821153, "uuid": "83928888-c06e-4baf-8a35-aa7b61b7392d", "comment": "Malware payload (Dridex)", "value": "bd855d3a97e9c09b253ebd3d9bdaf807af22dc7bcd48eb7ce531e9804197dfcf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821153, "uuid": "d6f74f0e-b804-4438-9171-fcd1c2da14ed", "comment": "Malware payload (Dridex)", "value": "dc1e31ff21fecfe98d1239cadffccf3a96991116", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617821153, "uuid": "03c00b81-0526-4af8-af54-adeab4931ff8", "comment": "Malware payload (Dridex)", "value": "28f0b569504a949e4404d1d9c3d26ca440b03133e6902b1de5f9032cf993ae70cf204354dbe9e73af18b2d5d7d718e37", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821153, "uuid": "242eafe4-55de-44e0-a228-59b80120d1d4", "value": "BA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821153, "uuid": "cc87b597-1095-47c5-8662-9c6eff882f5c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821153, "uuid": "d9d24528-eb6b-439e-8f64-1fe82db96dcf", "value": "3072:EBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:EBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617821153, "uuid": "93ef6c9c-08b3-4c62-99ba-2a66af3293d3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617821153, "uuid": "882f1ee1-38a7-4745-91f9-b63ba22e81a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617821153, "uuid": "2f2fb1f8-ffe6-4f98-854c-d2858956fca3", "value": "bd855d3a97e9c09b253ebd3d9bdaf807af22dc7bcd48eb7ce531e9804197dfcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b962d51c-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824693, "uuid": "ea06d517-81c3-48db-8cb8-439274623fc5", "comment": "Malware payload (Dridex)", "value": "e5a6a2c181b7159b45f6be1c066cb12e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824693, "uuid": "5d2a3192-083f-40f3-8811-bbd2cb069829", "comment": "Malware payload (Dridex)", "value": "be3001deabb3ab708f5f0baf5c99d268df0c4aa5c38cf1724eb577f2127d264a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824693, "uuid": "031a615c-bf92-4d2b-b691-90cd58b31cda", "comment": "Malware payload (Dridex)", "value": "74fa00261970af3ea4aec751edc4d64ff0dffb24", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824693, "uuid": "8a5b2753-e941-42cc-b758-99b5407b09ec", "comment": "Malware payload (Dridex)", "value": "f45227795ced5e834fc3cec92575c27ffa4ad59cb9261e410b5ac30a51755dd94aad4d6e1e569bd830059ce948e15ac2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824693, "uuid": "221469cc-a5d6-4b0b-a8ac-123d78e62bf1", "value": "9A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824693, "uuid": "de163545-7f3c-4373-96f2-d46293908bab", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824693, "uuid": "24ee7740-888f-43a3-b027-1d426fc594ab", "value": "3072:y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:xpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824693, "uuid": "e48b7d3a-cbe0-4594-bc23-b0b69068277d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824693, "uuid": "a2e435c2-4d38-44d1-9a76-285085804746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824693, "uuid": "8901aca3-d554-4e3c-b709-5bc23731523a", "value": "be3001deabb3ab708f5f0baf5c99d268df0c4aa5c38cf1724eb577f2127d264a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac86a850-97a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617800620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800620, "uuid": "8e461f3b-18d7-41f9-9645-eeadfdc42b4e", "comment": "Malware payload", "value": "9cccaef19cf13de3bff80797a3dd492a", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800620, "uuid": "edc9b1b3-b447-4c15-a75c-22da248e8ffa", "comment": "Malware payload", "value": "bf014d68f97aa342c5cfcb19906c8c0a5a6a05484426e7c46fbd0a28c92757f0", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800620, "uuid": "b69cac40-31a8-408f-8240-93104ac5d39d", "comment": "Malware payload", "value": "f156bd34e1f66336f79e9c02daa447e3102a3c65", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800620, "uuid": "46c49d15-355e-4cf5-ab6a-8bfa8a886287", "comment": "Malware payload", "value": "10d72efa7953ca64613c0806d2aab4860aee0b279b099c8a9f8f445ec9df25978af52d0628709101d6add5b583bb9115", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800620, "uuid": "845e2029-0e19-49aa-ac19-2bd7ab6b9f69", "value": "92F4334148DBEA3595493485D34BFC14EA8A3D9CBC346A76ACE0277FE80B50DCC49BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800620, "uuid": "7b1fbe9e-147f-43b4-9fba-bbd44e597fdd", "value": "12288:3KriJzhG4j11YMD5VJzn16e6rryFIBpXDm525OLj70SwbUFWo3BnQOyGgkVUkzZW:akzhG4lD5rTwDra528j0SUUFW4Q/Gf3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617800620, "uuid": "b68f5f60-076f-484a-a7dc-827f32a13229", "value": 782281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617800620, "uuid": "7f75d895-7390-43bb-a46f-a559a6966acd", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800620, "uuid": "65aeb943-37bc-4265-a4c3-bb24cdabd07e", "value": "DHL_AWB092837_998200_INV_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81534b3-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794707, "uuid": "e825312e-0805-47eb-a047-73e280602ba4", "comment": "Malware payload (SnakeKeylogger)", "value": "8a4280992397dbc550c9dee5e32f81c9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794707, "uuid": "6fcd08a5-c438-432b-8796-784fa815fb0e", "comment": "Malware payload (SnakeKeylogger)", "value": "bf5e5d62bf674f4c4fb247150e906105cb17a223a68de2758fb9281c9a6d8889", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794707, "uuid": "12383a93-1a53-49f8-990c-42254ec1c710", "comment": "Malware payload (SnakeKeylogger)", "value": "3a89d5d968ebaa6f2f71dd63a93c44aaa8f6cd8a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794707, "uuid": "cb628dfd-e405-4ddc-b881-899ace0c08de", "comment": "Malware payload (SnakeKeylogger)", "value": "dbbeacddbf8695fbd90f127dd1cca6e198233933fc7e61bbd0a47dd6671f45db96ac44ad21038cb54cc350d7979fd33e", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794707, "uuid": "a1bf085a-290d-4e2b-aebc-e6f0a2a1a89b", "value": "32E3239E10326DDB093DC1657082F778A11B8D55705B9EB6103C3D33D42EA6D9CAFB2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794707, "uuid": "3108af11-3517-456a-b0ba-32f148c28f79", "value": "3072:W6oHLxmkqoh9DBUmIPGhZJQBhigFz3BJw+zogj/ZVdyJgyh7BoArT:Zkqo2BQiTFzRGsjPsaysmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794707, "uuid": "597a2d09-85f7-457c-abad-7b048d58a579", "value": 151352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794707, "uuid": "d2bc177f-e88f-43d0-9e05-0a18be449504", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794707, "uuid": "47bf9984-078e-4b90-8edd-df8227fcd426", "value": "Order CG-210331-1004.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a27270-97b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617807454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807454, "uuid": "a458f0ba-2db6-456c-8efe-fb5c19e72c3a", "comment": "Malware payload (AgentTesla)", "value": "c09ca2b69268d3d5ad0243b64ea2a179", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807454, "uuid": "ee0d1686-9610-4bb3-ae29-caf86b7cb8f1", "comment": "Malware payload (AgentTesla)", "value": "bfbcea482de7b06844d5ec8a0a512d5e7f3fa0d0c8abb71586ddaed9c902665d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807454, "uuid": "3d025352-f973-4d6d-b03a-97a3c42c3793", "comment": "Malware payload (AgentTesla)", "value": "4d9b3411df0d8097bcd5f9726e540687bacb0989", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807454, "uuid": "d17f84c1-61dd-493f-ab43-9b8ff5c0a7aa", "comment": "Malware payload (AgentTesla)", "value": "05b10aa9003556e3e42430ad10a6b88bdc7bbdadae3db8205c69665bf523075c97ddf21b09c3013714654cf912b7a27e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807454, "uuid": "291f0c73-9de2-49bb-a812-c8033f5a6db4", "value": "2D15E02123D49B0CD07E57360921A70803F1BD6AA732D6D87DD731EE1E7D79AC762A0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807454, "uuid": "5588c61f-0264-4e02-ad16-fb8f8224182a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807454, "uuid": "5449b1d2-33a4-4480-bbf6-7a050ee5b79d", "value": "24576:5KfsoP5cPgaQ4LJfdQk6hYa/S4kBeXkeOWZv:5KfsjgUr+/1DXoWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617807454, "uuid": "9ab2c72c-2c3e-40ec-90bd-cedcc7b8d2ee", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617807454, "uuid": "c6ccaf63-09d7-4c14-9c5b-551fd5799015", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807454, "uuid": "789f5886-9d56-4074-beac-087c2829f829", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.28489.11155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab743833-97ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617806202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806202, "uuid": "16335cb8-d032-4a1a-9a7f-be7ac1adabe0", "comment": "Malware payload", "value": "00865fba20ef7d34ed136b9533401755", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806202, "uuid": "fdf42a8a-e580-41e9-beff-fc55f4945177", "comment": "Malware payload", "value": "c036d1c05516a8df5ea47b37cf51676e02f06ddc69532b600e3a9e1e50da3de2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806202, "uuid": "6fd979f4-3411-45d4-9891-44c2b9d0a7b9", "comment": "Malware payload", "value": "49d83871e2fdf8ca5f05c7eb67a580943cb930ed", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617806202, "uuid": "8134fd88-d578-48aa-ad73-dc3791ef92d8", "comment": "Malware payload", "value": "77bafc6855fe5c7fbb17db0645636b529c41a79546f60dfdd2d8b111d095ac7f3a5471e2ca2fc447cd0be5642b1054a4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806202, "uuid": "f0dc5ccc-6e9b-474e-8a75-13a6cb3471dc", "value": "37F5332AD2982922F7CEB0F2476451363806F4B5FB788960B310D6B7DC67AD675204FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806202, "uuid": "005d9cce-acee-4168-9cf3-a373b9d9152c", "value": "98304:DkZ5wtv3WPx7a9Ro/rAsE2/nwXn3F7ft+n5qwj5:4T+3Yem5Ejn17Vy5qC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617806202, "uuid": "cb781a57-3df5-495f-8cd8-e3d30e968c02", "value": 3609977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617806202, "uuid": "85024701-f3cd-4237-b311-03b607232f1b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617806202, "uuid": "54080155-5fdf-4c03-a326-80fe5b790e9d", "value": "Private doc.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13ff55b-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774831, "uuid": "427bf55e-decd-4884-9ca5-76b9410f00cf", "comment": "Malware payload (Formbook)", "value": "719b3f1cae125c176baf80b115c5d242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774831, "uuid": "2972d407-ed09-4d60-8d93-310621feafcb", "comment": "Malware payload (Formbook)", "value": "c064c85554afe2f28d863c91ad32167cccb8bfd909cea16247dc446f6556116e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774831, "uuid": "31edad75-9dbe-454b-8019-4a844eb1a6ee", "comment": "Malware payload (Formbook)", "value": "cb1e79b68a90f9ed2f89148b008e143377d1bc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774831, "uuid": "59651cd2-36a6-45cc-a638-2cb96ea75d4d", "comment": "Malware payload (Formbook)", "value": "3f76ecbd2bf73b6bf17ae62571d65ec7374aa36b13db37012a6ca6d183910bcc9e8f311369b8fbf4b4af4f8aa43ee897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774831, "uuid": "83096aba-11cf-4310-a760-2c6301c5f4c5", "value": "35D305B0D6E9B676DD64FE3590E8F3B52560DF026206C73A10EC3E23DBF1268956C849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774831, "uuid": "01a1b810-bbef-4c1f-bc95-6b6c6f8a0e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774831, "uuid": "c0435c45-5ccd-498d-9eb7-bfeae4a6a982", "value": "768:QyL9K0uvQbQZSp1qe1x/hs//gU1nLyg9G5XEAYDSXilB3Yd3tV7oIAX:QgKHjZk1Dx/hs//gU1nLyg9Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774831, "uuid": "61a185c3-3ec2-44bf-8d19-42661b3050bd", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774831, "uuid": "1f6cef7b-a7a2-49a4-a12a-3de806e19782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774831, "uuid": "18fcd1e1-59a1-4144-b213-8afa69f767d2", "value": "BL836477488575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f44074-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617772534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772534, "uuid": "4a912769-5b16-47c1-a9cc-7e248d72b658", "comment": "Malware payload (Formbook)", "value": "dbc18f36e9d613ea924deb385ef1b868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772534, "uuid": "f2a46147-0559-422a-80d2-2f5561cc5365", "comment": "Malware payload (Formbook)", "value": "c0ff5285d6f0561c2d500d93a45a2ab4f59812d060fb34e6767cea20f565cf47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772534, "uuid": "5fff08c1-eacc-493b-856a-693a431acd11", "comment": "Malware payload (Formbook)", "value": "4622460d1f373207dfb44aaadab7f125b8dce883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772534, "uuid": "4141d284-5aff-4f96-8596-5662bba086d5", "comment": "Malware payload (Formbook)", "value": "1d2e0f8d71ba376cfd0bb66cb9e7ef9757daf67485e2b37d281179e127f261416fe6336bac5fb09fcdd227eb34709e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772534, "uuid": "c8b3c44e-153d-412e-b19e-686a34a7220b", "value": "F824130572D0987ACB6403B119B9FB36E3BBD504B02629CF4F496EF77512592CA1E3E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772534, "uuid": "4294355e-cbc2-4bf1-aa1a-a0c7f13c8834", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772534, "uuid": "01d5b294-0207-4245-bbab-f39d533b8fc0", "value": "6144:NDIpUSnAa83HEwFlJ2/HDtgAiKr6cyT6rDnQz:cUmANU+lJOBgjoOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772534, "uuid": "e7ae1b92-3617-44cc-af24-f01da5f9bf76", "value": 226711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772534, "uuid": "9facdbea-4837-407f-ada9-15e63e43a73d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772534, "uuid": "b4c9a15d-7863-4de8-9de2-9728ffc81a90", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f30e68-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794408, "uuid": "1ae64025-af8b-4bc1-afda-6474129f190a", "comment": "Malware payload (Formbook)", "value": "41c31ea7c8aa660e61fa6b5d33f82d13", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794408, "uuid": "8e1ace08-7530-41a1-a91d-f9cb98f555ba", "comment": "Malware payload (Formbook)", "value": "c128f40d739c542e4f3c410aa55e3ee769df37a7e282279927f09cae1d630f1b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794408, "uuid": "a8e03cb3-cb8e-498b-8ad3-9ee2a6daefb9", "comment": "Malware payload (Formbook)", "value": "5567c4951677114023a207227f4f243ef52d087b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794408, "uuid": "c34c1c05-609f-460a-ac0c-0f0e5986c630", "comment": "Malware payload (Formbook)", "value": "c0470d7ab0ff945e747ee871936d8de0e8ea7ddd49815f71948259d4324933b440c96a567c279070f70e399d213ed8a6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794408, "uuid": "ed110bd1-2493-4d3c-bf36-4d92346191e8", "value": "BAE423E9422BF50D37526B6EF8F705D27283A92430405D9A6029317CD6DEABCCAB317D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794408, "uuid": "d92a42e7-405a-4f25-82bc-09df323a4cee", "value": "12288:Db4jMH10POUnRWiM1VgmPvgXBmbVP5uNG4dlsas7frU/CFE/AdYB5ahqf:AjJnRlMVn+BmhPYrlsaMU/6xdoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794408, "uuid": "b63deeed-7603-453a-a6e2-46384ec56304", "value": 702749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794408, "uuid": "af7334b3-8fb2-4fc4-a5be-f06904d3d44c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794408, "uuid": "65e6f581-3468-48fb-9e76-ab9065c50f41", "value": "TT SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a97abf0-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823971, "uuid": "6da22194-8afe-46f1-8aea-d8b9df00e5be", "comment": "Malware payload (Dridex)", "value": "0c859f3c5cb68befeb525d4a9bca92fa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823971, "uuid": "1ec45a49-ac25-4a50-a334-d885b7089454", "comment": "Malware payload (Dridex)", "value": "c18159d81139c688b9c2b1520158893c4c67f0e51cae777fcb90840200c3ff4d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823971, "uuid": "eb987bbd-319d-4a68-8407-b0e29247022a", "comment": "Malware payload (Dridex)", "value": "acabd4690d9c7d2459a1f19db8b14fda4b9d03fa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823971, "uuid": "524751b5-9580-4e1b-bc2c-0077907603bf", "comment": "Malware payload (Dridex)", "value": "eaa03e9805f46975842df2d9c6cf8ee5496a01ac193e58dbf6e37571729d10fae03195d6fa5b6484a840b127fb6a1d99", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823971, "uuid": "4afa1df8-9a43-4e4e-8204-e69258a733f5", "value": "7B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823971, "uuid": "880fa88f-cc29-4804-afd9-04202f0b23b4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823971, "uuid": "3a974e62-4b4c-45da-84db-fe8e0465b1a4", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823971, "uuid": "2ecd1fc7-8174-4969-b0be-30d52e944cce", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823971, "uuid": "fbe940aa-78a6-4dd1-bafc-73cdd2229df7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823971, "uuid": "a1c7c2b2-34b6-43d5-8b13-13a86cc4d4e9", "value": "c18159d81139c688b9c2b1520158893c4c67f0e51cae777fcb90840200c3ff4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f35503f-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824220, "uuid": "55728467-1073-4618-9530-800df91e6a56", "comment": "Malware payload (Dridex)", "value": "37e7eb3ac16f749348460350a5544ca0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824220, "uuid": "3c4ac5f6-e43d-432a-a5c4-98c9a57b7593", "comment": "Malware payload (Dridex)", "value": "c195ee9182e81217e53fc9fe550fb517d3ac3c9b2dd94243a1e599ef9e9a5391", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824220, "uuid": "79ea5191-1d61-4748-8af1-c9a18365da67", "comment": "Malware payload (Dridex)", "value": "b7adc5d23fa133ba0e8a2335184c13f1ac4dadc2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824220, "uuid": "b364bc75-bc46-43b6-b81e-402a4262809c", "comment": "Malware payload (Dridex)", "value": "d89bc7877bf072e1860eee4118c02e1da549846824658503d29c1e99f5b0d6b6e633e2efc084045c4a69fafd85047824", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824220, "uuid": "23196ba3-ff2e-4e95-a877-5b4aab7e551b", "value": "F4249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824220, "uuid": "b78639df-f2e4-4a22-9094-7ab1d14eed99", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824220, "uuid": "3e40e002-8416-4d3a-a3b7-815cd4afd25f", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824220, "uuid": "7e4dcb3c-eb91-43d7-a997-5f4d4d46017b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824220, "uuid": "87ffa2dc-4052-42f7-a621-5f0b17569a29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824220, "uuid": "5262cb3d-8782-49c4-b3c9-9f3a80f6279d", "value": "c195ee9182e81217e53fc9fe550fb517d3ac3c9b2dd94243a1e599ef9e9a5391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f550b55-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774828, "uuid": "e18663bc-af8b-4ef0-aba7-41e6da938b5b", "comment": "Malware payload (Formbook)", "value": "e9b68bcbf5dfc0fcce5c8c2e57f42090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774828, "uuid": "70a7f608-661c-4c49-aad5-07f598d019e4", "comment": "Malware payload (Formbook)", "value": "c36c6fd8b9b9f444675b6c97fa1dfa2c2fa05aba6c0f6f4f164e0cf7d1e5bfc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774828, "uuid": "90b01d9f-c4da-4605-8f75-699716775dd9", "comment": "Malware payload (Formbook)", "value": "1dc089d9da170cefd23e0c7b8fc3c6f5cb165026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774828, "uuid": "aab27880-ea7e-4a9b-9f6b-d0a69ff1243d", "comment": "Malware payload (Formbook)", "value": "03e98f010fb4060dd335320c6ba71e6365587918b1bd27f1538ec38132ab27ac0b2bc1050ecd8005ebfb986fec202ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774828, "uuid": "6061cd7b-fdc2-4fac-b952-a7c5a9c9e6ad", "value": "3C54F15662C3D0DAC9C5C1740D24EABEEA7EED2008536EA72F807F6F6A7DA0B450C157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774828, "uuid": "7c937eda-02a7-47a7-9fb8-0b2c7883bd5e", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774828, "uuid": "2b0eacfa-b94b-4e18-af1f-ab9e9af66db0", "value": "3072:eeYBCwqDxkJCfwr+eY+lDhuodEqV0IKfk2YzlcJ2w+F1OBoL/vmd9uKu+9mnszan:eDIwNhuQEqVXHrzlckw+BH2uKu1sOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774828, "uuid": "b6847896-3b13-487b-90e4-6fbd4b67c575", "value": 286647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774828, "uuid": "616979b2-7528-4230-ba47-5ee0850fb23c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774828, "uuid": "17e095ae-06ba-4cb0-9020-2bd863572d38", "value": "SALINAN SWIFT PRA-PEMBAYARAN UNTUK PEMASANGAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0cb081-976f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617779201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779201, "uuid": "4b8663e3-78b8-48bf-b4ea-b250be85bfcf", "comment": "Malware payload (AveMariaRAT)", "value": "d507f6899284562b5cab349e1082c297", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779201, "uuid": "a0756f52-6a60-4326-9279-c52ed7bbb3b7", "comment": "Malware payload (AveMariaRAT)", "value": "c44cd8ef8c5361ab56ad3d6fbf4d8eab7f531f9e12480626a461f4de8e4e827a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779201, "uuid": "fb162d42-6e82-46de-ac10-6291629f5071", "comment": "Malware payload (AveMariaRAT)", "value": "04f6718483f0590119e56edbb73420fa5431c9d5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617779201, "uuid": "6d26becb-f09c-4dfe-bda8-9728f932e458", "comment": "Malware payload (AveMariaRAT)", "value": "d2894e645e6bb2e98d15910e18030442784d03d4828cac09a00cdc71d95b6f1c83d1c4a73b987a788bc5447d9f056da5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779201, "uuid": "d29dbd77-4651-4ef1-80f5-e8cf39a4731e", "value": "BF53D2B9638CF16DF61B7634852477820A54B6A3282570B76190EF478EF2D6CB80F7D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779201, "uuid": "2254dc85-a7b6-446c-b382-2aa105a4bab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779201, "uuid": "04b3ad13-88dc-439c-b874-1fc35696be10", "value": "1536:ROKr04ys9h0GCQlJRrBw09r/202i8rCnQ/b0O4HtH:R14Rs9h0GCQlJRrBw09r/202i8rCnQ/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617779201, "uuid": "4966fa20-d062-4da3-af92-bc9520d689c9", "value": 66208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617779201, "uuid": "050cbd83-ec14-4e18-b191-a5cb398c4bb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617779201, "uuid": "74819eef-6069-4215-89cc-4a8170e1f40b", "value": "New Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88e1e4b-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824316, "uuid": "ea353c6c-ba9c-4293-ae50-21021b1f3199", "comment": "Malware payload (Dridex)", "value": "652b21c62ceb29a9dfe4c49b7bc799da", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824316, "uuid": "4fecc533-56c4-45e4-8ee0-24e634911764", "comment": "Malware payload (Dridex)", "value": "c5f7b1019507edee0fef83d91dfbd4ca3500525bfdf032844bc689e60c0ca7c8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824316, "uuid": "89382529-5d93-40ee-997e-dda7fbc4c009", "comment": "Malware payload (Dridex)", "value": "308c720376fde17b01d1892fc0c1cf304f6d8c20", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824316, "uuid": "dffddb97-b962-4754-81c4-43cfc31309a7", "comment": "Malware payload (Dridex)", "value": "e82fce16ab97e1160fe1f8b11606f8f158cc996a20880fab6b0e2bc40251434a0cdf96e95a5aad7d95f37b7b5290d1c9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824316, "uuid": "9eafa867-cc4f-4eff-bb7d-9a8aeb992e18", "value": "22249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824316, "uuid": "ecd465d2-32d6-488d-bb47-587d22bff95b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824316, "uuid": "42d1584d-95f1-40e0-a553-7c054f4bd0e3", "value": "3072:t0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:wpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824316, "uuid": "10a7d08e-97ce-4e68-abad-e327125a60e1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824316, "uuid": "c66a1a2a-c9d6-468d-9412-48f6fc274442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824316, "uuid": "ea1495f9-b66c-41ce-8b21-a12d5b170903", "value": "c5f7b1019507edee0fef83d91dfbd4ca3500525bfdf032844bc689e60c0ca7c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa0b014-977f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617785781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785781, "uuid": "9dbec2c8-7d19-4416-926d-6e5798c38b15", "comment": "Malware payload", "value": "61af8e293610790199986682724ac97f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785781, "uuid": "959fa7c3-577b-4831-9d07-406252b96401", "comment": "Malware payload", "value": "c7bd28b3954c74c8b304286a533d91e3188da52b9b604a723b6d1f9bdd216f7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785781, "uuid": "9117a789-5c78-412e-9e5d-bfb15016818c", "comment": "Malware payload", "value": "7c0f12907aadc91787c2bd4a1131a7c2840a01e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617785781, "uuid": "e96ea192-d662-4f55-8bfb-5bb0799244d1", "comment": "Malware payload", "value": "1a17a61e1a1d7108c22e295d0aeaa3d3ac229003a843635f2e8680135ebdd4ed18035cac98f2416a93dfc199f55e33a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785781, "uuid": "c49d9e8d-8831-4516-a628-4273a32c68fd", "value": "02C433E94327DE49FA6CD4342194B57606380E9F34881BC4A3441DD4D3CEEE9D98EBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785781, "uuid": "95cf6712-8ef7-48c5-96bf-caabdd4ebd48", "value": "12288:Dz4sll5sBVj1BPyYXfPS7QlGR1fTfgPQ++331bkVs:DzDlwVj1B5PPwRtTgP+nus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617785781, "uuid": "b0af3ad2-17dc-4153-b809-5f4638a6be2a", "value": 565315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617785781, "uuid": "8885dcc0-66ca-4e90-9c6c-5a976afb7f92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617785781, "uuid": "4f9a97bd-4a36-4de4-a3db-d98857101077", "value": "\u043e\u0431\u0440\u0430\u0437\u0446\u044b \u043f\u0440\u043e\u0434\u0443\u043a\u0446\u0438\u0438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b72552-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794549, "uuid": "58a4f8a8-273b-4e3d-908d-ba06545d6af7", "comment": "Malware payload (Formbook)", "value": "0a47028823a9d6ac37e411bec17dad56", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794549, "uuid": "f803b270-cd55-4fd9-b25a-c7f0a2f06456", "comment": "Malware payload (Formbook)", "value": "c8b96f9f31e8ae24043b7b35ca8cf6d66574b57c56746fe007ee6f4609d19b1b", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794549, "uuid": "50dbeae3-89fe-4cce-9289-b4a8cf50109a", "comment": "Malware payload (Formbook)", "value": "9de8dca3ce8658c576dec622dd81e4f010255bcf", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794549, "uuid": "3e099bdd-9e4f-4060-a822-605cab64dd2e", "comment": "Malware payload (Formbook)", "value": "61a713e2ecfb0394c1fca6b41e77f825adeafb16bd7b5e68a26aa0cfbb963137c72f9c51a0911680b4197247b8d762d0", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794549, "uuid": "bca18c3f-1c20-43a9-9cee-683d0d4494c2", "value": "52C433B15CCF54AA07927C2ABC402C6D23A3C154636676264D78DF60BEA2C7BCE74E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794549, "uuid": "0b6844c2-d552-4189-b849-e882f38fb219", "value": "12288:AS6fQZSec/s+t96CbTwcNhIAhN9/0FC1Wb54wapYLG9sxba3g4URlaM:L6fVeYD9NB2FMACwyYLVbawBRMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794549, "uuid": "76974382-5142-4a18-9feb-ede5409a221e", "value": 563046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794549, "uuid": "e787bce5-245e-42ae-a7d5-28bb3031f428", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794549, "uuid": "61d12f74-c21c-4606-a3c7-271bf057fe82", "value": "Bestelling.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c67aba9-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617775226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775226, "uuid": "5d66da7d-abab-40e5-9f0a-be16263df200", "comment": "Malware payload (RemcosRAT)", "value": "c7e1546f914c7a662cd6c373d716f50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775226, "uuid": "41cd2743-b621-42fd-bd40-c9a8ae2e8bdb", "comment": "Malware payload (RemcosRAT)", "value": "c9ecc8ac0893475d6852cd5aadf9ed6c5378e45f281b92ee948def1c7f9263f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775226, "uuid": "57b3847b-0eb8-436e-b0ed-8683630f2a7a", "comment": "Malware payload (RemcosRAT)", "value": "312769e3394d26f430f75d5fca5e680ff9efca7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775226, "uuid": "bb862df0-700d-4e07-bf05-14c70dcfa1b5", "comment": "Malware payload (RemcosRAT)", "value": "02b4364b630edc5f2796cfb09b79e04b2e1d8d687794514f82920cc31c1500b21058052753e66d9034599fda5df9fad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775226, "uuid": "e418294d-8a98-4ad9-b060-8e95a0d21746", "value": "7905E02233847F65E17EA7759060416093F6FD07E336DA8E7C9CB49D6932AC1C262B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775226, "uuid": "9c440476-9ecc-4e06-9dc2-42807300e7a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775226, "uuid": "4eeeb5e8-3201-447e-aac9-2a986a798b5b", "value": "24576:YebsanDn4AomQlSesV+qQ8B8cHvNlEXHPzj:UaDnn7QcjHEXvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775226, "uuid": "5e4ed4f6-c5b1-4c7a-9a0c-4375c801efa8", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775226, "uuid": "ad34fc6b-339c-48cc-ac76-eff758f37e17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775226, "uuid": "3ac9cbcf-18f2-439b-a178-0438c1b045d3", "value": "PO-#3175704534,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67678c68-9738-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617755407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617755407, "uuid": "02cd6581-46f9-4e3e-a766-2e4d28680293", "comment": "Malware payload (Loki)", "value": "87b99d0c7ec5450a3a4480034ec7f890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617755407, "uuid": "e9d1a161-5885-4f0a-9cf6-a2205adf2fb2", "comment": "Malware payload (Loki)", "value": "ca4a895f81aec93ce01e2290fb643471f26fc4a190f5f65fbc1ae9647e00ad75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617755407, "uuid": "4a994bb5-62c8-4b60-b223-016d65cee631", "comment": "Malware payload (Loki)", "value": "161e628addfd8cf9e521f7e565178cac6f8cc948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617755407, "uuid": "a8907230-e7a1-43be-8273-c1c9f417220e", "comment": "Malware payload (Loki)", "value": "54d5a46b8a7510b322526c78565263a5a5e9d19066ec86b6cd64d07bca3153a0457d45c4c4060f75da93313413879420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617755407, "uuid": "403c23e4-e869-4090-b6bb-d0b119e765b1", "value": "83C4BD146EA905C4E9EE37F41860809107BDAD167BD2F71DEBB475A81A32633CE10B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617755407, "uuid": "85b2e02b-43ce-4c74-8ad6-c2e137316bdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617755407, "uuid": "d3a3d713-c693-45b2-8475-8c3cc436ad2e", "value": "12288:m2LexHmUm+0mqdPeotQmenoFYPw8ezW+lkRRnxK1hiCMYO:mJxHt6BdGIQ5qY48ecDn8XiCMYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617755407, "uuid": "201cec7b-148e-40d8-8288-10e9be3e3d6d", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617755407, "uuid": "e2fa3802-aaa9-4b83-b6a5-0203922a49ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617755407, "uuid": "aebb5e60-0b71-484e-aa25-64cd0211e25d", "value": "RFQ610016934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded11669-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774935, "uuid": "7d6f9db8-8012-4b25-9754-831923e51a95", "comment": "Malware payload", "value": "d90f0c1cb32a90eebb9af686b4111f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774935, "uuid": "e0362d26-1652-48b4-bcdb-c84e6e69b6af", "comment": "Malware payload", "value": "ca5c84227de65ec7edf59848ac42f0558f11f9148196814d194570ef1e30dc83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774935, "uuid": "797a3716-1cdf-4633-8649-b850e6c95519", "comment": "Malware payload", "value": "592c6e5e4db97a930dfaf51351a585f9f75d45ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774935, "uuid": "63063f2a-a5c3-46d6-b562-53a31b2a58df", "comment": "Malware payload", "value": "1d58be1321b6e806bedb01ac8102e0788e5c7befe9882cfc7870264248c1dfdfb19d8bd76d876b247463ee1ecb0a0b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774935, "uuid": "03d1fc4c-f809-4734-9ab1-09af3d575492", "value": "7A35AE085A4405DBD4D936F084696B4002A86EBD7B92F769FB707147B9327B3CD2362F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774935, "uuid": "b2b4d5a9-f7e6-44e2-b18d-b9be426e102a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774935, "uuid": "bbdf6c99-520e-4032-90b4-a2e9a7bc0e3f", "value": "24576:+8CNPq6fgPvAp2o/dF+/ryCJsv/5X7vSWgRSYXtj/9qy:+nNyxHoO/ryCmv/5La/vtjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774935, "uuid": "88a44ac0-0bc8-4b2a-a817-eb37e482376b", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774935, "uuid": "b0341d4e-44fd-4cd1-b0fb-bd435e6ef609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774935, "uuid": "2579a116-de03-40d6-a56c-bfbf1eaded9d", "value": "000OUTQ080519103.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7075140-9786-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617789014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789014, "uuid": "bb7fed02-90ab-4f39-bf26-23870bb51887", "comment": "Malware payload (njrat)", "value": "b58d5ce4532a4e33a261778d4c3ba976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789014, "uuid": "217fb5cf-52ce-47cc-bda7-fa937d950a2e", "comment": "Malware payload (njrat)", "value": "cb121700c196dd52b183b9ddf49fbce730bfe191fa1beae93ae6a162b33fd203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789014, "uuid": "e04af04c-9641-4191-86c3-d50c5ed314a4", "comment": "Malware payload (njrat)", "value": "4efc95b64e5c5138c6bc0efae97dbc2e2e7c0938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789014, "uuid": "91a91126-2750-40aa-a0c1-a22a58e9ea30", "comment": "Malware payload (njrat)", "value": "f79bfe47eb99ae863090f9b71272eddce3bece055e53d9c06052cb7e1dc2434fda77c024ec88e89e566a034957f3e6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789014, "uuid": "fe7c686a-0695-4080-9c48-2c0041383399", "value": "8A93E84977E52524E1BF5AF39471F2004E38B4871602E79D48F259AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789014, "uuid": "956cd02d-9697-4273-b880-bc538ba9d5f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789014, "uuid": "aa532ccf-4a07-42d5-9896-c8edffabdfd7", "value": "768:mY3MUgSgmnldjcRoMwrx7Y+DIkIITJbXX0pOtzux82WXxrjEtCdnl2pi1Rz4Rk3b:GUumlbrq+1NTZrOojEwzGi1dDWD2gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617789014, "uuid": "16024199-3682-41fe-b34c-8dfafd6b3816", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617789014, "uuid": "be62d412-c2b4-4edd-b94b-df7f379037d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789014, "uuid": "2633fcea-ac1e-46c3-bfab-5466090ea539", "value": "b58d5ce4532a4e33a261778d4c3ba976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ed9522-9757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617768559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768559, "uuid": "f212f74f-6bb8-4cf7-8d2c-fc66bbe4e82e", "comment": "Malware payload (Formbook)", "value": "dc50e476cb2dbd525e459cae7723e003", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768559, "uuid": "1ff094d2-d45a-4da2-99f3-e914a5785dcd", "comment": "Malware payload (Formbook)", "value": "cb76978500df6a63528a85f99e642526a40184195da2173f5990ca6fb9a15e7d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768559, "uuid": "ffa130ac-d034-46ed-8e82-46145d786d7a", "comment": "Malware payload (Formbook)", "value": "a5b70de48686e07b3549a8218b22fb370908ca8f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768559, "uuid": "3d56389a-2f6c-471d-9902-e62b754afda7", "comment": "Malware payload (Formbook)", "value": "b55a7ef8b459bf4f8a5b0c59b700d92707ceab5672906979f11ef3cad942c651895e62022b6e1f0fb87ca5c083a00236", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768559, "uuid": "c7f7df15-77a1-4fc1-ac12-16f87ad50194", "value": "D0B42329E990CBFF7049721144EF95CEE9B88850DF7058AA21B85688066F44FFC5BCB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768559, "uuid": "130bb65c-44b0-4e6d-9746-3edc995a8dd1", "value": "12288:Yn5i0L+QWugU3xtsL5Hd5LjdAS8hEfboeakCV5t:Yf+QW1595DDfbohkCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768559, "uuid": "a5b5e698-e75b-480b-9e05-9d880146e3f1", "value": 530242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768559, "uuid": "f5f23ec2-1eec-4df3-85b3-47d1c51948df", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768559, "uuid": "1db17809-4706-4419-ade8-99627d6239e2", "value": "PO#41000055885.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dd3864-9790-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617793329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793329, "uuid": "c2ae9f73-4656-420e-aa48-3c3d12aa952b", "comment": "Malware payload (AgentTesla)", "value": "60ef6553cbb1e36da02c17a639bdb13c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793329, "uuid": "09ba5f8e-c1a1-4273-af53-a4571fd844a6", "comment": "Malware payload (AgentTesla)", "value": "cbd84f6edacb90a5ce8c775df1407f377b95bf05653fc3ffa49e3c9f453eda39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793329, "uuid": "783c7065-dc2d-4310-991c-09bd88103775", "comment": "Malware payload (AgentTesla)", "value": "2e16d1baf2637e560543a035619504d133c0c2c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793329, "uuid": "de5ab44d-f394-4978-acb3-0654f3ec2c69", "comment": "Malware payload (AgentTesla)", "value": "48b07b369f02842eb41e90f873ebbe0e8e5b2223c34376e75f5a3cd124055ef74ca59c84e25b6cabbd5b92887699ba27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793329, "uuid": "dd75c2c6-b68d-4cac-b9c3-b1ff92447ecf", "value": "590501243BAC5F40E07E6776013690A017F1BE6ED336DA1D3ED871CD2A76A484A77B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793329, "uuid": "22cf1425-8115-4c25-8af9-0019ce7433b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793329, "uuid": "42a1c3b9-6a20-43eb-a97d-c29906f70f8c", "value": "24576:jozjR6XvCFkmRTIo3G+WED0oyOi1ItLCh5vf3:joz93FkCpLW20oc+tLCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793329, "uuid": "b23bfb3b-2050-4f42-a715-cc3f629f86ee", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793329, "uuid": "c0c5ff43-ec01-4794-a9eb-b07878d15f74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793329, "uuid": "8a174df3-7e04-433e-9d50-a4df9b9b876e", "value": "Bellinger ordre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99cf29a-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774926, "uuid": "2baaf9b0-7b3d-4855-977a-f5dfb2ffd184", "comment": "Malware payload", "value": "4ff30eb5d68be2da4f1ea33f866544cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774926, "uuid": "61c450b3-51f4-44ed-92e1-b9a3a0279a89", "comment": "Malware payload", "value": "cc4a75a27a80dd0c34ed04f12235a3424715b7c546b530e138b58aaf0af69f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774926, "uuid": "3013f6ad-39f1-48ba-a060-4d1744c342e3", "comment": "Malware payload", "value": "232e689858d7e4367acf4910620a95b0cee040ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774926, "uuid": "b2b68f49-ec33-4d5d-825f-abd5df8f6166", "comment": "Malware payload", "value": "f27fa61c4b58c97c89831d45fc35c08cac6c1a21bb309994d7ce6e1650818bea58262316101881203757c9066cbd523a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774926, "uuid": "ca02203a-8627-4cf1-a719-be2a8ebb2858", "value": "1D75230BB56C979EDA8486B1763E1338822DAF4706646C90BFD5FE2D313218DAE531E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774926, "uuid": "ee9da2f9-22d6-4354-99f6-9a995173ed43", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774926, "uuid": "6d431790-35f7-4adc-869d-bc7d6fe68631", "value": "49152:MjViiD3Vxdnv5J15NOWTzJNnfh6A4/GmXmY:gv5J4WrnfEAiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774926, "uuid": "e204e239-9457-494d-8c88-34fa0933774d", "value": 1679997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774926, "uuid": "02cc4440-b2ba-499a-8a2e-f2938d8bfe2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774926, "uuid": "a72205f8-541c-4add-89f2-b9d07eaa8cad", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba04149-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617768218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768218, "uuid": "8581a113-d810-404e-9b62-7092e1b015fd", "comment": "Malware payload (AgentTesla)", "value": "f3ef30a6a4832ba7ea6c03584f27953b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768218, "uuid": "fef05783-179d-4db3-9199-6300d8166787", "comment": "Malware payload (AgentTesla)", "value": "cd00804c03731bc4790bb8bf19771d549974f5f8e1aa79f5786dd689ceace789", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768218, "uuid": "f2eafc05-c8b9-48f0-9535-e143bd76cf4d", "comment": "Malware payload (AgentTesla)", "value": "bc3c630397afa99c01b0a06a11c1e32d2ea01eda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768218, "uuid": "e2ee9504-d28d-44c3-9649-dab6a0541d84", "comment": "Malware payload (AgentTesla)", "value": "f3cb91cc6b6b10e63d560000bcdde23bc3d0fdff497838c5c31b9f6ced2a64c2f264c8c36f256e5f5a8b31b5e69f3dd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768218, "uuid": "36a5ab0f-8508-4f3f-9310-98fa8e1e94c0", "value": "65C4238E3444C74144846D8C04596FB3833CBEAD9ED64AE3BB4A917FC3648DB6D27B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768218, "uuid": "a0c0f050-55ce-4166-8f6a-e8ba89ebacfd", "value": "12288:0IP1mhPX3BpaZX7IpeBrtWwLR8e/8LdRjNUYZAzI4tK:DWPX3UIIBrtW+k//ZaJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768218, "uuid": "8965f7ee-0809-43e3-9cc0-337cccc5ec34", "value": 548647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768218, "uuid": "1717c8ae-3e39-4e61-b543-094d7f5f9622", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768218, "uuid": "a1753f35-466b-4b92-ae59-5a21f9eab2bf", "value": "Overdue Payment_USD.106,375.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ea5b1b-97aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617804547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804547, "uuid": "4e423e5d-a78b-4146-a4f9-e4b665af0df8", "comment": "Malware payload", "value": "45efd42402270c8c2c50a46bff38b00e", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804547, "uuid": "b10b9d0d-02f3-4197-9282-31500c59d49b", "comment": "Malware payload", "value": "cd197ac98e2c65978a6b1140addf32eb0cf275785944e0b2d29400a4316ff718", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804547, "uuid": "12223291-4b2e-4834-9096-56ac4e362e4c", "comment": "Malware payload", "value": "8ac1927cf9e6b5c753009932ac4660a39939e2a3", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804547, "uuid": "30ed9036-76fb-47b5-a94e-f64802ebbfaa", "comment": "Malware payload", "value": "39662931492bb7fa73557761d98c931a9a61c3643db0146be1b0a1ba68bf17ff391a92a3697b818d2d133df3a028a96e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804547, "uuid": "91080228-cbfd-4381-979b-c65a1078615e", "value": "D5D3012A8D72E135EDDF50FC82610F27154319CA95C8583FA9F1099EA8AACF60D0DE7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804547, "uuid": "1f6ea281-2a89-4377-9695-5debf16ec010", "value": "3072:z9cn/iyIdJUnJmC+6H96qiuFsciyhA/R5EMW:Rc6yyUnQhUsuFsc/hAsMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617804547, "uuid": "64eb5d96-d935-4a2b-a49c-6ac2405798ce", "value": 135488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617804547, "uuid": "08e68284-f2eb-4219-9625-1803659c5541", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804547, "uuid": "92a74b36-f95a-48fe-b0df-d551f01d7d08", "value": "234501209-416_000_decrypted.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67c6673-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617794704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794704, "uuid": "255d4491-e798-46cf-aa2b-05960cd6303a", "comment": "Malware payload (SnakeKeylogger)", "value": "d896b1f95f3aadad88c47bb0ecf74f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794704, "uuid": "dc52d42e-7ea3-4e7b-9f30-36cd0ee53a59", "comment": "Malware payload (SnakeKeylogger)", "value": "cdbd526134259454bf3f7c9d9d81ad12a301f2d207347c201cef21e188fbf924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794704, "uuid": "10d5a2f0-cecf-4826-b339-9fa70dc26f39", "comment": "Malware payload (SnakeKeylogger)", "value": "c87a295e1d053ecaa8dc2470b1528b5850470195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794704, "uuid": "fc935ba3-e823-47b1-9581-140d18cc474f", "comment": "Malware payload (SnakeKeylogger)", "value": "1a1e3f92c81cc580770f031aedcc725d030d3702a4a37f5ca349edc09e49ff17fc72121ed1fc098a7c8429707c3c04c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794704, "uuid": "f3a93a42-e75b-4a17-8874-816400cc964b", "value": "B40501212B985B90E07F673A0531645143F2BE7ED736DB0E7DC872DE2A36A448673B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794704, "uuid": "b5139bce-a199-4aa5-9490-3be05341ea9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794704, "uuid": "17972e63-cc5d-4488-8874-102b061e287a", "value": "24576:j/w2av/OunLiN8+LLq3XYlD2vB2dNMVxEqldd:j/wXm2LiN8oL6o92J2XMVOql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794704, "uuid": "08a39169-ea3c-4aff-b937-2522f4515db1", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794704, "uuid": "8db1a139-670c-4d75-bc52-95da94e67160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794704, "uuid": "be287c42-aa99-4549-b6b2-d3e9d6595118", "value": "PURCHASE ORDER-34002174, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4404a496-9760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617772527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772527, "uuid": "bc89a2a4-c576-4302-bd30-01a632fab5f0", "comment": "Malware payload (Formbook)", "value": "f8f00ad041221c5225fb1487b0bfff72", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772527, "uuid": "9aa357dc-fd17-404f-8e03-22840ddafe4d", "comment": "Malware payload (Formbook)", "value": "cef4f9e5b0c16f4e0778d04dff1616f74408682c923821aaf9aee9c47b867535", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772527, "uuid": "4a8e7f3e-3378-45ed-963d-4eab746c2f0f", "comment": "Malware payload (Formbook)", "value": "daf588bd2ae2686079d74372dd511c12a27ba19c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772527, "uuid": "9a47b46b-9db0-43d9-b814-1d54a9f11e3d", "comment": "Malware payload (Formbook)", "value": "e7a0fd5238a56145dfec2e8dbc51274ded98c6369637124305e86d66594aeb66af96929fcb464b529e3b69365b56279b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772527, "uuid": "6ef94e59-9487-4b5f-9aac-efdda577e10f", "value": "B724232FD490C2821A15F4DDE52074481827A8DDEAA88FD6EC72860AF572CC65FC9FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772527, "uuid": "99c89a33-da91-4cbb-a4b3-bf80d93db1bf", "value": "6144:IxI6NS6caUJKWUO+LFbeVqNMLZpFsWsFqkn3JVzBZx8py:IrNZcaUJKWCekNUP2FFqMJ5BL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772527, "uuid": "43eb1d19-5c48-4768-b13e-bb3ae5435243", "value": 215124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772527, "uuid": "67144d68-c51a-449a-acd2-a30db9e9d540", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772527, "uuid": "ca5ef79e-530c-47d7-9142-3a05f900040e", "value": "PURCHASE ORDER.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5f8919-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774878, "uuid": "3ff6747d-d3f3-46ab-af50-143f611210fd", "comment": "Malware payload", "value": "e64f253c19ae648ae74eaf62ebb779ab", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774878, "uuid": "5836ae9b-46f4-4242-b4b7-6f54c06f1004", "comment": "Malware payload", "value": "cf1693cf0d6bb6c0370fdd17549588f8ce97402446c4ee4b1f76b7af8a8355b6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774878, "uuid": "e21e5e7e-7775-457e-aab2-77a0d3caa94b", "comment": "Malware payload", "value": "73d488289de1e74c8a23c1112d5f77c338cd4706", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774878, "uuid": "46cf2eb9-a265-4069-bd24-3e0362493f9d", "comment": "Malware payload", "value": "671013d28a6a91d45978d1ad875a5cb478c6bfb9eb6b8071ed58a4c8e37aa1c84f2676c42bae16611c3141650ebb2a11", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774878, "uuid": "3ff9e33d-c8b7-44a4-be13-cda903dc168b", "value": "3492A65BF9E8D53FF62833B63BBB8A845234B24E85FBDD2F604E6047869225C01915F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774878, "uuid": "27916aac-7b13-4aa3-a555-9491f4f58295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774878, "uuid": "eba3c533-4d47-47d8-83f0-46b045c7ce0e", "value": "384:Ykviqy/T7EqLQFLEF7Hgch0AxppRvK6vPgdlb+4lB+iSXVbtV27ReH:Yuyr7ELLNOfp3SECWpFbtVRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774878, "uuid": "c26da5ae-2a9b-489e-9fe7-7aa1bfa7d0b4", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774878, "uuid": "f8fb3ced-ab6e-49cb-83e6-f640348f3726", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774878, "uuid": "9db64768-a4b5-4a9d-bdb3-f59edb8ccf86", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086bce26-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824396, "uuid": "ebf5842c-bbc4-4d55-91e4-f34ba48ec908", "comment": "Malware payload (Dridex)", "value": "e11582f826106a07d60612c6b6352991", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824396, "uuid": "d72fcf4f-61bd-4cd6-979b-46c7cf0208e5", "comment": "Malware payload (Dridex)", "value": "cfdbdd46b975622fb15e82cb0d1c5b5feaf76cec9fae12ba2509d5fc0451b5d8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824396, "uuid": "453cc13a-e184-496d-9512-b9b315ff54f4", "comment": "Malware payload (Dridex)", "value": "e4a057acb02cb95ba6788f48b9d1e1197487cf9c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824396, "uuid": "07b45016-7f1b-410d-affb-9f44a6d775e7", "comment": "Malware payload (Dridex)", "value": "29c19b025a67d73a6afe43ee3cba78a974d4981fd3e4ce59abada86f143b3f9bea8f2d08577b7ec97cb1ae2c6ab7418d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824396, "uuid": "4516b23f-2c02-4739-845a-cce29dbb27e1", "value": "D8249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824396, "uuid": "199b7885-d645-4084-b9ba-3cd3b7429b6e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824396, "uuid": "8917b2d6-b36a-48c1-817e-b84f9a35f0ce", "value": "3072:V0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:4pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824396, "uuid": "f805e4ac-37ef-4a58-9ee0-db718fe3cf5b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824396, "uuid": "cfe9b5fb-c3b6-4191-8b43-b180901a49f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824396, "uuid": "49641f55-786c-4ad3-8331-dc31ad802aa1", "value": "cfdbdd46b975622fb15e82cb0d1c5b5feaf76cec9fae12ba2509d5fc0451b5d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e72c278-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774827, "uuid": "02e3ae0f-7c51-4838-a570-8b4bbfb34819", "comment": "Malware payload (Formbook)", "value": "3a20237e5ee90c6cf326477daee17bd8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774827, "uuid": "5171e1e5-7518-4acc-9b95-d5a6e6c2870a", "comment": "Malware payload (Formbook)", "value": "d0d8d8eb59807b54198aa881e835099cfa7abf9a1f8f28751862264931741f04", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774827, "uuid": "472b5a83-c191-4bba-88a9-cb9bd087e036", "comment": "Malware payload (Formbook)", "value": "d29c15774473cef1a21abcb7d4886702bdf89ae9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774827, "uuid": "176cb9b4-91e5-4808-8805-59b30c8d1368", "comment": "Malware payload (Formbook)", "value": "18ded82b73bb77f8d01fee63908a607910e43773340c2cc6e0eaf7e6474141a81b226a2834f60a0601996f3ac5e93371", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774827, "uuid": "17663014-5518-4524-977c-4b270f9c87a2", "value": "7F74E0166282D0DAC585C1740D24EAADE66BED2008735EA73F8C7F6F6B7BA0B450C357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774827, "uuid": "3c5e9d56-cb76-48b0-b220-5c736eb42840", "value": "3072:QeYBCwqDxkJCfwr+eY+lDhuodEqV0IKfk2YzlcJ2w+F1OBoL/vmd9uKu+9mnszac:QDIwNhuQEqVXHrzlckw+BH2uKu1sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774827, "uuid": "ca769675-f588-4ca5-925a-e532f6e85b2a", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774827, "uuid": "c4b7b692-57ce-4365-9150-c3c21fede2f3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774827, "uuid": "a961548d-2cf7-456d-ac76-9f7281c377d7", "value": "SALINAN SWIFT PRA-PEMBAYARAN UNTUK PEMASANGAN.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89280a16-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617775220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775220, "uuid": "40596bf8-d4a6-4bb6-a6ef-c3f2d25c5d41", "comment": "Malware payload (AZORult)", "value": "56a2f09870771b8312d1a9b10b6446aa", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775220, "uuid": "76052b2d-ab5c-47d0-9e9a-2236d432d77a", "comment": "Malware payload (AZORult)", "value": "d1b9a434579f456d75afe539d5b100d21cd57115bdf946c684dd9ec4e02996aa", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775220, "uuid": "17ce0f91-203e-4202-8a6b-ce7448c059f3", "comment": "Malware payload (AZORult)", "value": "d1eae9e4ccf62b54f847aaec3e015251663cd06d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775220, "uuid": "7401a799-6caa-45a8-b472-58de90a16746", "comment": "Malware payload (AZORult)", "value": "021ba1f612927d89c40a15c3ae95a1307dd0d7fe0aa612bfc02a834e290ad62eea875069ae8faf24305bb46108d1bd8d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775220, "uuid": "5ab8f33c-41e3-4575-9c15-d436c4b6a786", "value": "5FF40150B746CA51C89907F1E9A784830375FCC86C23EFA64988B2D9343574C9DEAED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775220, "uuid": "aca75d0a-4e8e-4f18-a6a3-32307fc98967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775220, "uuid": "7d86bd94-858b-4856-93b9-583e4db3f732", "value": "12288:/lOl1+yzsXbe6KLkxL0aVttTT0YKmcdBh27UkV9dL0DvsPzEswvPS:9OlshS63xLdrMNPBh2Tx0QzP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775220, "uuid": "9fa0119f-85f5-4d51-a366-137e05abbe81", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775220, "uuid": "9f67a37d-0977-439d-b843-4b0e0cb0dbf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775220, "uuid": "dbada8e4-92f7-46bd-ac14-10393a844166", "value": "Credit Advice -TT6635993652908.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ac3c6a-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617774941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774941, "uuid": "b44b6d4c-2c51-44a0-abb1-4c045c383e38", "comment": "Malware payload (AveMariaRAT)", "value": "9710a8a9857b099694317f05c4da703e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774941, "uuid": "44ce25cc-e39a-4099-88d0-f4b64319c134", "comment": "Malware payload (AveMariaRAT)", "value": "d266e212f266cc2c64e151d3543e34beaed2a3666fa215c2a88d8a042b6e9a4a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774941, "uuid": "d3d7c950-76ca-47c6-a916-49865b0f9929", "comment": "Malware payload (AveMariaRAT)", "value": "3faa03b1a2f63f42008c0a736b8faad86f114f5e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774941, "uuid": "78b5afbc-9953-4250-ada8-46d2a4abbd12", "comment": "Malware payload (AveMariaRAT)", "value": "3e7fd66b83208a30ea0ef89288618c787c26b5e14c4a932d4f8a01bdb3c28a310ecf52390e7eb0b518b815469572761c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774941, "uuid": "74fb3171-ae19-4710-bd2f-253587a85ae6", "value": "67F401207745CF45C4A943F2896685434371FDD87823CF9A8A48B2D93436B8CADEAED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774941, "uuid": "b7984a80-77c7-47b6-8980-ab6e3650ed2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774941, "uuid": "cd2f2206-92ce-43a7-a9e5-2b9c2a49333c", "value": "12288:twYlt+yzsMXewyyKJTw6vvOoTg2b/L6XGsaE7Ei:yYl0hMOJTwGT0GHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774941, "uuid": "0c2832a4-4e91-4084-8381-8d318e04f2cc", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774941, "uuid": "0bff2d42-debc-40fb-a0b4-6c33d95a887b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774941, "uuid": "e4679e83-9577-4af7-8064-28a2f1035029", "value": "POVdRnvBDNdZ0tZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9223a6e8-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617774806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774806, "uuid": "48f680bb-4521-4176-8ac7-8f01033e096e", "comment": "Malware payload (SnakeKeylogger)", "value": "099aaca5ff44fcc163a8fefebabc58c8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774806, "uuid": "7e27b916-c318-4448-a695-ca1a300b6d6f", "comment": "Malware payload (SnakeKeylogger)", "value": "d26e919fb8d6afdb6c24176ae3c33672e24a7dc9a759b9493b8a88c027613016", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774806, "uuid": "38226faf-8d3e-4aea-a208-b82bc5238987", "comment": "Malware payload (SnakeKeylogger)", "value": "57e7ca6fbb5b176b4ef1ace051c86e2485f1632c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774806, "uuid": "9e326ef9-9626-42b1-8b72-336e3ae78724", "comment": "Malware payload (SnakeKeylogger)", "value": "7d66c8f887a6ac22d977a47d10ab790aa52c6f2231b94a61dffe4f655334073cb9e09e719f1116f4f289d35e71c98f0d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774806, "uuid": "ed1b41a5-114a-4b47-bb61-b4b495420e26", "value": "D9B4235F3FAE9621F9D3A3A0DD3021275F7A786526A564A7CC0AA3007D15FBEC400BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774806, "uuid": "1b40febb-9e0a-4903-a196-35d82e2d9970", "value": "12288:aMRgDCst/Ai4lih/kUPLBTOswuzwgFfhQaQIKL:a7DCsOihsUTBTHZQJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774806, "uuid": "cedd269a-b9a5-4936-a6bf-f6ff22b0399d", "value": 521730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774806, "uuid": "4e455855-bf61-414a-96b0-ad4e09645019", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774806, "uuid": "3e68b87a-846d-49ff-aa5e-765b89253d27", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e47d0c-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794426, "uuid": "c19bd856-2205-456b-9f06-cd6e9df66493", "comment": "Malware payload (Formbook)", "value": "171027ed6afe9db69fdaf585e2c3d3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794426, "uuid": "55392fe7-0efc-4bcb-8160-625ccf61418c", "comment": "Malware payload (Formbook)", "value": "d337cba627486e1f99e4a96407591609d888c6656a4010b88047e7cd1ab19482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794426, "uuid": "fd1a2bd6-d538-40e4-841d-b8ff1527ef89", "comment": "Malware payload (Formbook)", "value": "ff225a8461f665cb7b7a2f30bab7c60fa3cb0069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794426, "uuid": "74e3da4c-03aa-463d-8550-d5b9454157a9", "comment": "Malware payload (Formbook)", "value": "a061d871a30f16cf35a983ab31c4ebfb3f1ed71b7a07cf91c2c8cb2471316156920252d77b1af51678e03fa4ed250412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794426, "uuid": "7c8707bc-6ce0-4da4-8d40-5bfe48e6cc4f", "value": "E884BE1173E1C032D1A364384A65C7B54ABE743267A55ACBBBC41BB94F247E1EA3730A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794426, "uuid": "495d0395-227d-4411-95b0-af8515df4cac", "value": "ed583f61644f9a196f94a929459587d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794426, "uuid": "bf078a17-3a80-4c53-a8d3-861f76d03e42", "value": "6144:ijN1DaX6G88LbtMaYThhYQoahBUkq7odyjMgHsBOyqJi0axrE9TCq3Ij1jV:iZRaX6YNTYThh4abUAdb8csitwZW1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794426, "uuid": "0ba80c03-175d-4bd4-a4d5-62098f0c081b", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794426, "uuid": "11ee8e26-5a8c-4bf5-b94d-53ea775afe17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794426, "uuid": "ba5adcd7-3481-4537-a57b-9954af32c5a4", "value": "46578-TR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998e76cb-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617794575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794575, "uuid": "49f09eae-6c43-4145-b583-a9bdd8ba0d3c", "comment": "Malware payload (BitRAT)", "value": "9ee396f30db2375df1ab7e935acbbcac", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794575, "uuid": "a79a2d60-41a0-4f12-abc6-26f86ff45bea", "comment": "Malware payload (BitRAT)", "value": "d431d6c234dfb75c3fad9cfe53c800e68eec1df826aeee43cc02d802a234e0c2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794575, "uuid": "0513a830-8d29-48aa-9d05-86ab4b667d93", "comment": "Malware payload (BitRAT)", "value": "bc256b355899f7805e7313d9834767e8ab73312b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794575, "uuid": "5c494d5d-001b-4956-ad5b-38fc8b2de431", "comment": "Malware payload (BitRAT)", "value": "f5cb9be5cf31527195187ce13a68b80143ba339061081d91e6b5ef40cc67e845dc27e464073f911117427a6fa77d31ed", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794575, "uuid": "2560bb84-906e-49b9-bc3a-fda857c1350b", "value": "35B512E669E0A201F70F377A1AA7D51EC936AD227C30AFDCB51B726115B2FD908C1B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794575, "uuid": "ac8576d8-7e0d-4238-8d4f-86df4ceec1b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794575, "uuid": "a04ebf5f-b84a-4573-9b92-aed47e5b83f6", "value": "49152:NdSKw1LSbBGRPpaif65XFH6hLufnSAq58PUYY0XO226/ag:NdS5+bBGRP0SYFHILq5q0T2YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794575, "uuid": "208f62ec-1800-4734-b6c6-7418b9737a7a", "value": 2474944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794575, "uuid": "12964763-3e25-4546-b634-708046228e4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794575, "uuid": "5175e8dd-ba24-42b2-b827-58f0321288d8", "value": "ORDER343346PO3455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04667156-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774998, "uuid": "8fb69e96-e952-4f94-86d7-f282cb562b11", "comment": "Malware payload (AgentTesla)", "value": "ed5ff6866b115f070e80160b8d10bf0f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774998, "uuid": "d56f113f-d771-4c23-a039-d1ba71dd08c6", "comment": "Malware payload (AgentTesla)", "value": "d4abf50f9fd0aee8e6ada5a478e2d84d37d010ed92239705a7438f4a3c9a5435", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774998, "uuid": "5a43a367-ea55-48eb-b8ba-ec30cb8f7448", "comment": "Malware payload (AgentTesla)", "value": "9a895692e545483bbc9ac0390771acadc37d0eeb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774998, "uuid": "a5ddd359-66de-40e1-a55a-95682e9bbfb3", "comment": "Malware payload (AgentTesla)", "value": "6a25bff2e419fe92a864283eb611bb1fde723b741ad29adac2ba1bf9cacda7c933024052795e8f4f4ae55d3b08324e59", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774998, "uuid": "83a68664-25f7-4d9d-a7df-57107ea9c600", "value": "DA84234EF37A89B73E813C9CC1D709854D6F91654EB7F7E9E32C8B9D2649588AD02E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774998, "uuid": "e65fa054-4f2d-4e77-9f0e-185dc1fc1bee", "value": "6144:ssSKtviB4bD+N0y6ah3PZyVDqy1MfLtPhgPJwtgsnVEt5Equt9+4owzbUzieJ6ZW:sAtviObDRy6i3PwVuUKLlhk3snVEt5jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774998, "uuid": "18207617-8021-4614-8e9a-15c4b6351e8f", "value": 383073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774998, "uuid": "c7cc8fff-bc0b-4edd-ab1a-dd13203c5c98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774998, "uuid": "2411cad2-7f4b-4808-b27d-a22ad38bd25a", "value": "RFQ040820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a58be1d-97b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1617807461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807461, "uuid": "892efa6d-306b-4faf-a537-89895ee6612f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3a582c51c5ad029f8788849e8b059ee3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807461, "uuid": "6771d464-d298-4c39-b815-99afdfda9266", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d4e27b8e7e1fd965522468bdc3eaf06513dd3a3e7402d9b441ab002dfc892adc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807461, "uuid": "d6c984cb-576d-4242-bf38-51a44119f88c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "fed468dae346f17da1c0b15359d6927eb5e11d82", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807461, "uuid": "8bfc4191-b116-44e6-9974-78abafac728c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "80154f43ed7c5cf384fe9e8686c183479eac221f880bbe3e87662b912f5c3e59a8eaf4a2a07db071dcc91d18946dbc6d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807461, "uuid": "d1404786-87e6-476d-b7e2-d95d852e0293", "value": "64950280239C0B6FD45085B2AADB742943A9FE4795FBD3C66B8742CC48864618ECDFD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807461, "uuid": "85fd4473-ad6e-494b-b484-c3e73112cf0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807461, "uuid": "3033044f-653e-41de-a52e-94cbf537cc15", "value": "24576:3gOVtshW4El8BYPkb8+WQciGxJ18bHOL0NsTPPow9ZAEalzjdjodhTrrrbC/oY2e:31QwlGYOydBxraHOwNsTc5jee/o37c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617807461, "uuid": "62fa0796-0bc7-4242-82a4-5021bcd34114", "value": 1889992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617807461, "uuid": "e6a4529c-4604-4d9c-a65e-41e2e7479fd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807461, "uuid": "1b967788-ace4-41eb-abbb-a3db6b0f5277", "value": "SecuriteInfo.com.Malware.AI.4002960471.16400.6181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cff4c9e-97ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1617811331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "639b539b-ddfd-4cdd-9def-f019b0880dc0", "comment": "Malware payload (Sodinokibi)", "value": "726d948d365cb9db1dfd84a30203a642", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "364b1775-efa4-4b25-9a25-a0f5fabdc6ff", "comment": "Malware payload (Sodinokibi)", "value": "d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "8348c2cd-551c-4486-adb7-22f7a9b5d197", "comment": "Malware payload (Sodinokibi)", "value": "78ed4bcf9c0aca8d14b25da2e679a91c48dd6797", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811331, "uuid": "7582ffd9-1ce9-491c-9c2f-1bf3dd76dd26", "comment": "Malware payload (Sodinokibi)", "value": "30da57d3b53409589a592574d9643bcf6fa8a9843e36ecaebad449000e50e8ef3ebce185a1d4b53e18dbedbd348eaa44", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "9cbe1591-c503-47c7-ad5a-b021c5337c8b", "value": "20C3DF23EDA042B2D68381F3032F7F6799BEFD32192014ABD36089854E765D1D716767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "a846d57c-66e9-4e0b-a1ff-cc4ebdbb71c1", "value": "b321b6896e18906d7c1d33f3e88fe16b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "a2473ab1-3105-4030-b19d-02857940ccd3", "value": "1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUkdq0tK3CmZ6+n:mmV1wKdLoLC/OemUkdq4WCmA0qG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811331, "uuid": "feb88dc7-cd35-48bd-946a-25b75efafc53", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811331, "uuid": "a0e78e5d-42e3-4106-91f6-3b1cf33e628c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811331, "uuid": "37469d75-f3d9-4b20-b02e-006e041ba936", "value": "d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a457145-9787-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617789422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789422, "uuid": "fedce98e-1f97-4440-a9bf-7f7b1fa081c8", "comment": "Malware payload (SnakeKeylogger)", "value": "182af22f9bef22c8b109aaffac9a3552", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789422, "uuid": "63043de8-459e-48bb-9182-53420593a395", "comment": "Malware payload (SnakeKeylogger)", "value": "d782e58762927bac570591d8698d4224b4981bcb0748ad3f9589c51a3858d06c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789422, "uuid": "4b54e180-45c5-4f9c-8198-f7b10ea87718", "comment": "Malware payload (SnakeKeylogger)", "value": "4797f4fefd49596c18f10959e58cc88ac72c33c6", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617789422, "uuid": "ead5ec62-83f0-4f9e-a8ca-2126bf96d729", "comment": "Malware payload (SnakeKeylogger)", "value": "45cde42dbacbcfab300b8a449b6dd27556e5aa188b1f0f66456f6021cc7894476f11be78b2ccbdc19381e3eeefd0aed6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789422, "uuid": "6c33c7bc-61c4-4e8d-b22d-f4f621d8d145", "value": "25A42356A1C2C1B3FD450BB5D4232BD9E07FAA2D05D8A6B71B249BD7E47C283FE10806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789422, "uuid": "c1094891-93f1-48b8-a64f-6e78762e0b23", "value": "9c523d8653da5455667e3f82274f2f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789422, "uuid": "f335c05e-78bd-4366-9919-06f5fc5d700e", "value": "12288:aQeMiCJXMLIZizfRCrpo1x4CDYnSngFHa:aXMZyLIkf6oxxn06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617789422, "uuid": "169675c9-3da8-43ed-995f-139c48d7dc80", "value": 455337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617789422, "uuid": "54db538f-6984-43d5-b034-f38acbb1e981", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617789422, "uuid": "19261a6c-a3bc-40b8-94c8-35535847e1d9", "value": "Invoice,PDF.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620564dc-97a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617801783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801783, "uuid": "2171ad35-4671-48ad-a168-ddcf686922ce", "comment": "Malware payload (AgentTesla)", "value": "67a5bf44bd6908a091a74edce72e5f05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801783, "uuid": "cd7b957a-37d0-42fb-bebe-fab6fa485bd7", "comment": "Malware payload (AgentTesla)", "value": "d7b92448ecfd7f178e19428933ffcb94d7df6ffcb255839b508328d060811622", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801783, "uuid": "341c399c-eff5-4b33-b2c3-87b9c2c9696f", "comment": "Malware payload (AgentTesla)", "value": "9019bb29f4dd372309a8af41666e692da7859c23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617801783, "uuid": "98e2e099-3dd4-4df6-ad73-93c9749cec20", "comment": "Malware payload (AgentTesla)", "value": "beea1004a7beaad74e55364c5a43f26e3dbc08e359a84b96aafd06a99cdf249da8665e1e1b1c3d14c44b2635c5933a1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801783, "uuid": "b5fac35a-3cda-4a21-8a44-8428e01f36c8", "value": "8CF4CF9C3340B5DEC867C972C9991C11EA21F4FA671BC713901716ADA90DA8FCFA49F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801783, "uuid": "1b79dd9f-fc0d-4a5c-9261-0a4174d3d2e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801783, "uuid": "1338a329-0e32-40ab-92cc-f657b2bb037c", "value": "12288:FE/02iNP7FX9EUGYBZRVbYu9QhdTbMHejorInsSpw7Wy2aT39WcD55d8rTaAHl9c:Fs01p7IUFtYu9QhRAHejPvw7WJa79154", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617801783, "uuid": "f4c9efe1-1681-47e1-8728-2c3c283063c9", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617801783, "uuid": "c4816bdd-164c-4c39-84d9-efb0b782463c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617801783, "uuid": "af01c2a4-d2f3-4f8d-8124-434df90743fb", "value": "MU3666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e47ee-97aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617804198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804198, "uuid": "225506e3-7087-4499-9d50-06fe917708eb", "comment": "Malware payload", "value": "6af0a5df367c82b472826322db754912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804198, "uuid": "d2ba9890-f9a0-4fb3-9d23-df8db565321c", "comment": "Malware payload", "value": "d814af14bc2fb8e5a66fd36a327eaadaea29269967ed6af99dc7c9ff3f7b8f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804198, "uuid": "f92e7b30-7760-4205-8178-6775fa642d2d", "comment": "Malware payload", "value": "3202f60d4b7f9f44deb245778dc4639ca89f4f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617804198, "uuid": "aee60b0a-0312-4b86-966b-86dbc14745e0", "comment": "Malware payload", "value": "6c2b2c7a445a7af07d97d5f7ccd99ca02f7dd2ca9944ff94477af99d10871edc936032a16d436da6fc2383da4d337d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804198, "uuid": "14157ac9-2db8-4614-90b9-604357f4d45d", "value": "3B25CF246C4425C0E8ED3AF28861D57052AEAD027BD2F718ABF07D9BB972637CD5061F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804198, "uuid": "5f00e672-a11b-4483-9ece-d5bde58f7998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804198, "uuid": "2dcc763e-4e4a-4f26-9601-02731effd8c9", "value": "24576:Z++bOvoQlHBTwM4c5ruK84VLNMNiOxmtfy:JbxQl5CJs5MNfxmtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617804198, "uuid": "bb528b09-34df-4ecd-b5c0-e03e3c4579be", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617804198, "uuid": "0cfdd36f-d8ae-412b-af5e-7a2364c997d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617804198, "uuid": "7658dd30-cf95-4b7e-8faf-90176c19d3c5", "value": "Inquiry 040721_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc219e2-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617774933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774933, "uuid": "c6df5878-8d60-48b3-8008-3e19fb9c8583", "comment": "Malware payload", "value": "e3dfc7314c31a6ffb488a9325f62ce94", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774933, "uuid": "30bd16e1-4de2-4e3e-aa10-9f3e1d38af23", "comment": "Malware payload", "value": "d8eba15b26d5652ed7cf6a67ec0f3b847fe7179aafdd414d092d25163eed9b3e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774933, "uuid": "5d001ebe-f35b-474e-9acd-7ba7b048eaa5", "comment": "Malware payload", "value": "83fdd2c3a72a8fdfead4204dd94660863d149fde", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774933, "uuid": "188ff48e-6009-47a5-9cea-684dc09756ea", "comment": "Malware payload", "value": "ef8e76ad661d22a6966582db376e6ec007e3286a04eea4dcb5b1438bf3fea82f2f5a8f47a878c31a5e56bde65026de06", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774933, "uuid": "5e8f33ff-d033-4134-af66-f0b94f50b5e8", "value": "5015335B5F03AF150D87FE32C1517706BE1502855858EEEF3C86A4BEA69837C0BA568C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774933, "uuid": "6f00482b-a2f6-4808-8131-6a4ac51df4b7", "value": "24576:QAjPXlLLzs6favWNc2IsmbpNnFMFpT1cpYDTC7MG/hlHg:pjPX5zbfThmbpQ/5ci/WM6lHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774933, "uuid": "bda79b39-1cc2-4455-8740-940475e3ff37", "value": 934661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774933, "uuid": "489697a5-ca95-4bb5-b592-1ea53550836a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774933, "uuid": "a83bffca-9115-49b3-896a-bd60258427b4", "value": "000OUTQ080519103.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d0d9b0-975f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1617772121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772121, "uuid": "3e2302fa-b941-4240-86d9-7ce2d86d3175", "comment": "Malware payload (SilentBuilder)", "value": "d8ed80402de2b621219044b3a2c022c5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772121, "uuid": "f06229d8-ed91-4f3a-b99c-12403ad1034e", "comment": "Malware payload (SilentBuilder)", "value": "d98b11f1599985cc16c8dd10ea53ea5a1b9ac752d5d30c460c198b4a2a83ad9b", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772121, "uuid": "0fa93d82-fb32-45ae-8131-8568c8a08216", "comment": "Malware payload (SilentBuilder)", "value": "e2f86c9431081da7f57cc014a9f2f7b870ea0aad", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772121, "uuid": "54aa9a91-dd96-4631-9028-b428953ad508", "comment": "Malware payload (SilentBuilder)", "value": "abb62dc2e978bb743a52f7496bcf34a43d5ebb7acf53bfe446a312f1464cd7f9303c0eae056d8574858594b71ac48828", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772121, "uuid": "2893ace6-245f-4c40-9385-0140c9cc1b78", "value": "7144E6D2B2029128E0541F3AE572067C82E6FFAA7B18F49B6C05B3B77B771D13E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772121, "uuid": "0f08a691-c8ab-4fd8-8a47-7757b76c484d", "value": "6144:JcPiTQAVW/89BQnmlcGvgZ7rDjo8UOMIJK+xTh0E:FhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772121, "uuid": "bf51d147-f6f4-4d18-be1c-e5021d138b20", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772121, "uuid": "48815e53-9659-4e70-bfb9-85b7ad2edd29", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772121, "uuid": "c1ecca4d-7713-4f5a-bbfa-1af37767a7d2", "value": "1A8C92C-1A8C92C.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2e2e72-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794531, "uuid": "8644ecd4-db91-4486-a2ac-6325aa181642", "comment": "Malware payload (Formbook)", "value": "2ebf540d2509b7086a15a8a3b531bd74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794531, "uuid": "bfc4b424-daca-4d47-87d6-d085d046ea0b", "comment": "Malware payload (Formbook)", "value": "da1fba1d66a44b77440ec136dec09f921d932d5ece0d35030e7c22d50f73bc8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794531, "uuid": "40862d06-0d91-43a9-addd-4e15ba919c4d", "comment": "Malware payload (Formbook)", "value": "d1e7e0c3ba73aef8feccd337703569ebd5f8121a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794531, "uuid": "dbacb3f1-1cf5-49ff-a0ca-0ec07ff95f1f", "comment": "Malware payload (Formbook)", "value": "bbc1621ab3d198b5a7a046830044eb002c11db73f13cd6c522012aab834d5430c6ac7dfc8ba665cfdf82d5f270096acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794531, "uuid": "cc12c6a3-f64c-430b-8f88-73408f095da4", "value": "B705BF86FA8096E0CC1D9375693BCC354723ADAE65B4A50C24CA37772FB7BA30036587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794531, "uuid": "294b314a-1106-4ab5-957a-9aac5ba93452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794531, "uuid": "02c4b6d1-db49-41e7-98e2-85ce06331155", "value": "12288:KLrNpPWkRYzFWY2HdQBdbQlSvyOiyCyYP2Dm/KL2tRFuSppvppMkkkkkkkkkkkkL:kP+kRGFWneD0SvyOvu26/iYOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794531, "uuid": "7781f238-d302-4776-9d1a-5e2d8ca87c5a", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794531, "uuid": "967d33cd-cf73-4672-9428-d4a3d8551623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794531, "uuid": "80cf122e-ea5b-48c8-895d-8ce07e697c54", "value": "Radix Pvt Ltd - ME1-PO-20-2690, FUL-015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a492abba-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775266, "uuid": "87393e1f-ab1a-4b91-9b5d-a396653e2e18", "comment": "Malware payload (AgentTesla)", "value": "c6d667d6bcc207032756eda7ed63ddfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775266, "uuid": "2f14f99e-e026-48a2-b521-1a837543dc61", "comment": "Malware payload (AgentTesla)", "value": "da2d92f0b457ef9553ed1043f410926daa39f4a8605e1725fd547428c59ce023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775266, "uuid": "8993780d-8956-414c-817b-47914f0bfef2", "comment": "Malware payload (AgentTesla)", "value": "9adb5e97fe8b1cb3b0bdf94fb25232299ca6ffc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775266, "uuid": "98f8f4db-bd3b-4449-ad1c-75c218f1874e", "comment": "Malware payload (AgentTesla)", "value": "aba12e8affa705b30986e55600ec960012b3ee6073445d5e95a15e3c231050f3d77e2a28bfc1d4eda1d2a51e21886e98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775266, "uuid": "d98d0e6b-550c-4b91-b5cc-1c6702d23d84", "value": "D5F412363944C407DA5E1AB5C498C1FC13B2FC56E92A12877CCC7EBFBB7B65922052A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775266, "uuid": "3b6490de-8e17-424e-942d-045701f74ab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775266, "uuid": "7f799985-0187-492f-a71a-44ab3acf0e19", "value": "12288:uVJ2ocwi17L8EcvbyBC2VPyOiyCyYP2Dm/KLkrTn7xBeevAdk2y:qJpY7LOTyU2VPyOvu26/ik/nlvZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775266, "uuid": "e75b5056-6192-4dc2-9e6e-ff07c4fcd814", "value": 740152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775266, "uuid": "070bae8e-4e96-4e79-9354-764efe58a403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775266, "uuid": "93b4ac47-641e-4538-aec3-77abd317ffba", "value": "MT CAPE AZALEA V219 PENAVICO 13-10-20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e870b9-97d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822809, "uuid": "0b2cbbef-e68a-4594-bc24-626bbb6a9521", "comment": "Malware payload (Dridex)", "value": "8a9ed09347ac9b5c3310e14f3dbc1ade", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822809, "uuid": "353538a9-23d7-49eb-9d82-838f3f0f5bea", "comment": "Malware payload (Dridex)", "value": "da6a501ee701b861da40ef7a9ccaeb5d972a68f1c7effcf58a1afbe1c3e6bdb4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822809, "uuid": "c0843760-aab3-46fb-b325-c1a58b50ff91", "comment": "Malware payload (Dridex)", "value": "d1a3728d7a79f9e2f67658c6650cbaf267d2f6e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822809, "uuid": "b5c5e6a0-8b87-42d3-8427-a88706c85e41", "comment": "Malware payload (Dridex)", "value": "e3314f0c113749ca2e5c41296bcb3d56d93cdd87393f23ba4c1d6849ff40578be49cfa06c015f0abb48c2d7dafed074a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822809, "uuid": "fc062cca-2f01-479f-b65a-813b8ca93700", "value": "0814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822809, "uuid": "3becaf0d-4966-40e4-bbce-93c2c24581b8", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822809, "uuid": "53f0fa99-16ed-4005-a168-b39bcafd2043", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822809, "uuid": "29057d1c-8cec-429c-90bb-a12b35596318", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822809, "uuid": "bac45319-54a9-4194-8ee8-c018b71812a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822809, "uuid": "c29d98f0-25f6-4f49-8103-de61caa2ecce", "value": "da6a501ee701b861da40ef7a9ccaeb5d972a68f1c7effcf58a1afbe1c3e6bdb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2cdc59-977b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617784085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784085, "uuid": "e6299fcc-591b-49cf-998e-a3d475f345a0", "comment": "Malware payload", "value": "1f719d23f55a8f6da4bdc6c8f3c0bbc2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784085, "uuid": "9b94e9d0-ea95-410a-92d7-81cb8ac6e26f", "comment": "Malware payload", "value": "da93c773b0f9e0397fdc09972b8479fae2ea698d966902ad74f4c997931892da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784085, "uuid": "27ba8922-bb59-48ed-a834-9b6805485c2f", "comment": "Malware payload", "value": "7abf0a9d8820bb8de6ca2750b044cdeb0fa58ab3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617784085, "uuid": "bc9d53fe-1b79-4190-a3c4-f1eda89c28e6", "comment": "Malware payload", "value": "0d84d6b96bf27e6f16e02b30d8a4864f57a70868ac801a4995ee7f67619811e0df01eb74ee7ab713bd1c21444d56dfb7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784085, "uuid": "b5fc0879-e5fe-4e04-a560-3bad3adfbd06", "value": "88158D88F140A19DCC1ACB319935CC359622BCFA5637861E10DF3E6B7B7E68F8D544A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784085, "uuid": "b63d9879-3462-48c2-95e2-c8e9b1b59c37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784085, "uuid": "0c9164b0-b52d-4524-83aa-7fd0a21a0b53", "value": "24576:4y3yi1r0cbu9hGvIMZc9Cvqb/taTnpSQK1q:j3yi50hGF3vq4TpSQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617784085, "uuid": "f089225f-8baf-43f9-8dab-eea9786ed9d3", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617784085, "uuid": "d22139c2-2024-43d6-b3b2-dfa852f27f48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617784085, "uuid": "66bc8d55-068c-443e-a100-aadc8a1ff558", "value": "PAYMENT ADVICE'.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb446a0-9792-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617793940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793940, "uuid": "8ce27192-00db-4d96-a0ab-75b702e61628", "comment": "Malware payload (AgentTesla)", "value": "4ad2a26c2423a4b84f031f5ee6d4193b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793940, "uuid": "eabd2210-e38b-4d24-b13a-b8cce937c178", "comment": "Malware payload (AgentTesla)", "value": "db882ca6d7897e9afebb3e1e33b9568306e5087ad1d0bf3facd4ddc8c8907956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793940, "uuid": "9a9c8a85-db5d-495e-808f-21db39528319", "comment": "Malware payload (AgentTesla)", "value": "7ba747822b0a2fcd1e47d194f66f1cd58876a63d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793940, "uuid": "f011dfb8-fdfa-447a-923b-e2a0177fae4a", "comment": "Malware payload (AgentTesla)", "value": "2356e9b102846427913e802c4d7d410c90067b812da364f1c88c4090899c38b4ac317eba65734b09eee80350f57ba786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793940, "uuid": "ebb91e7d-8008-4cdd-ace9-d6681ca3f315", "value": "6EC533694DC6AB3AC8288972D3D7D570033A9C24B981061233ACB47C76377B5BED729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793940, "uuid": "368f6575-74f4-41de-88de-e82640bb7f6c", "value": "49152:2/gpxGmhComfamBmR/IMHFNKlehYT/Jwd+rMn0xMphlCBBMbPeVF509gtNX:mKGRnBkQuYlehCiyM7hlC3MbW50k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793940, "uuid": "644b5ec7-5192-4336-880e-f3f8b53b96e5", "value": 2727424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793940, "uuid": "8f108287-cc4c-48be-8710-cf0a64876bb4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793940, "uuid": "68cd7bb3-f7f8-44ce-8fec-ff6cd7bd5360", "value": "Revised Proforma.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0c1ea3-97ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617805236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805236, "uuid": "488c9786-e39a-4bf1-ad72-085c082fba39", "comment": "Malware payload (AgentTesla)", "value": "15ee79993098017508179eebdbe7d0a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805236, "uuid": "d84f92b6-6a0d-45d1-bbdd-1158ee7eeb10", "comment": "Malware payload (AgentTesla)", "value": "dbf286bf8cb86f3a95aa938fc6616f5641c91a7579a24f9c6a3d6241d4b482b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805236, "uuid": "3660f8af-f492-4b56-a577-244ba35744a8", "comment": "Malware payload (AgentTesla)", "value": "e34a35fea61c1529c2872f71cd70f9ce2ccdfa20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805236, "uuid": "a5dfc57e-665b-40ee-9d0c-726ffe46e1e7", "comment": "Malware payload (AgentTesla)", "value": "9e402b5ba78b3e93a6b405e30244e4cfdaab26c91f7dda532f65e91712d272da639bdf60b019de6044d1931e67780976", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805236, "uuid": "0a0b4425-8207-4a77-acf7-de997bb682ed", "value": "CA358C111B18BB9FF56927B20C53CE4022A298E18561FB2DFAED27DCC47E97DB03A145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805236, "uuid": "8b6e9494-4af7-419f-8cdf-ab15c85b2bad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805236, "uuid": "c3a67c14-aa33-463c-95af-9425779abb49", "value": "24576:R7JUIM+mUQ+7/dvWs+QAZdrI+tzorQHLaXKJnCExvy:R7Ja+mN+JWldrvzCQrfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805236, "uuid": "215df420-3edf-45d7-a03b-63d725674cb6", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805236, "uuid": "1408bffc-9ffe-4c97-97e3-7de024e039d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805236, "uuid": "ed8ef07c-bea9-46a5-b3c6-feb4bc77f46b", "value": "LIHUA Technology HK Order Items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7698e83d-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775189, "uuid": "929edbdb-da9f-418c-9f43-fdf9b4ca420e", "comment": "Malware payload (SnakeKeylogger)", "value": "84ff29666a3f4a81c1b3160cd476556a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775189, "uuid": "502cc669-abb1-467b-8f8f-7b0436f87319", "comment": "Malware payload (SnakeKeylogger)", "value": "dc377a33af6a32885d2ad71c2f0495372f5aac992d25fa0239ecc9aeec1d482b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775189, "uuid": "9cf6598e-c874-4254-b078-048574509117", "comment": "Malware payload (SnakeKeylogger)", "value": "51c58431480c59a0b0999991eea13f894fd1c1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775189, "uuid": "0319c8bb-e35f-42d8-aff4-7599912f8bb2", "comment": "Malware payload (SnakeKeylogger)", "value": "9e1e138fb1a0295cf5a24ba7c2b89b58d56506f72ad7c20825e9bafedb890782e0c02c3ccbcfedfaa89c8fc602cd9125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775189, "uuid": "2dd4e7c6-a6a0-4712-b1d5-7aa24357f33f", "value": "372548132EC4DA5CF0E95B3E51FC01217FA3D886961ECFCA68DB73AD05A1982F121A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775189, "uuid": "d15d8a24-6b2d-4bf6-9616-c37444f3e47d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775189, "uuid": "a0d4ac78-ebcd-400c-a57a-1b79553581da", "value": "24576:wGbLa7DnfTnkldn6SVM1tRbZU5UO+bSAp5D:/aPnr496S+1tRa5bQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775189, "uuid": "bd8a928b-5332-4dbd-bac6-43d4fae41c68", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775189, "uuid": "02bf3bcd-d6e3-4e12-823c-844b33cf78a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775189, "uuid": "ae3dc283-034c-4337-bfbb-52bc00c4a249", "value": "(RFQ) FOR MATERIAL FOR REPLACE COMPONENTS FAILURE OF OIL GAS AND MARINE EQUIPMENTS PROOF TYPE AS ATTACHED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96386063-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774813, "uuid": "658a2bfc-5b9a-4f2b-96e4-925c15b12579", "comment": "Malware payload (Formbook)", "value": "0b60cb4adbd7eee0f3b9a4fb32dc8dfa", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774813, "uuid": "1928bca6-03fc-4795-9b1c-c34e4814fdff", "comment": "Malware payload (Formbook)", "value": "dca570fb7c9d0514639060f7230cf92f8b851c071bebe8d79b66ad5d8bbe1481", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774813, "uuid": "c81fa42c-49bb-46f9-ad52-f79d7fe89889", "comment": "Malware payload (Formbook)", "value": "63323a001625838454a3a368fbb4a2a48f968a2c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774813, "uuid": "b17291a5-7c76-4cd3-b940-aaf7a2145858", "comment": "Malware payload (Formbook)", "value": "b100fca72979507b0334baf90da6708b792d3cb2179cc91cab029cba3c0a7bb056609ca3e764aba6d67c25e01d34f3b2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774813, "uuid": "97b12fd0-1abf-4797-aab4-dbb2e01f1a36", "value": "CDB42328C2D5C7CFE0234BE7CC6513C7A1F9AC56CA70C86C5097E960E498A5857ECACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774813, "uuid": "2f6677f4-42f1-45a5-ba6a-f4623584e79d", "value": "12288:t+31ZSk4BHRJZCjkdX+IhFG8N+/DwKdQJFDFDKQu6Gav5Opnj/rM:tyHSkkLYjkIVuxDKQujtj/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774813, "uuid": "7e465e7c-c616-481d-8025-530666a8f51b", "value": 538516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774813, "uuid": "1515b774-82cc-4176-8964-d05d59ea24e3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774813, "uuid": "3c8c6c55-2d9d-4b5b-b4c9-0822f00a089d", "value": "New Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb8404d-979d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617798929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798929, "uuid": "97e26225-3086-4a7a-8f4d-c720c7bbe66a", "comment": "Malware payload", "value": "26194533127b81a2e6957b920c5b27f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798929, "uuid": "55aa8f38-5818-42cb-9f3d-df0d15c52ea2", "comment": "Malware payload", "value": "dd4a9a91785a114c43e766fa5510586338863cfbae280b8158483522eed40152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798929, "uuid": "31fceee6-9530-4183-80d3-99d2c32aa4c7", "comment": "Malware payload", "value": "69e313531a653495398de6edfa5f1460ef8b1e2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617798929, "uuid": "fc01f1be-8de6-4358-bb9d-9fd424690339", "comment": "Malware payload", "value": "87018b614470d8f48736417c7bafe117f60c3426952241beab94f0a356bebe6cc76ea9a9452f7cfc1c579f367e09cfb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798929, "uuid": "64c1519a-0ebe-46ec-b1d4-a199ba93d74c", "value": "BF1549D49E4A79CCD4AA36F1341080FC836B6C1226C9E39697F7F9DA8773522CD5068E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798929, "uuid": "9baafa25-731d-4ede-a11d-dfce81003d1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798929, "uuid": "366aeefe-3791-458b-b8d6-fe10fa694d3a", "value": "12288:r4Cj1ilHLPliYjHRTgIA7r7gPJlCm6L+2LmS8PPM6erjk7ICfLcd:seIiYji57rUPCBLLmS8M1nCfLcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617798929, "uuid": "cf111252-5cb2-4c2f-a168-34352b6742a4", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617798929, "uuid": "f9060ad1-8dfd-46f2-84e7-a7c730ae1ff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617798929, "uuid": "3a35b5e9-3619-43dd-82cf-24b076d084f4", "value": "April_2021_Purchase_Order_000000000000000000000000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e15170b-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794422, "uuid": "243cd102-d6ff-4c8a-8045-f3fd41759097", "comment": "Malware payload (AgentTesla)", "value": "3d92ed8388943a0047236ccd4e141afd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794422, "uuid": "dc2ce477-a01f-44f4-a0c2-84f95fe919b2", "comment": "Malware payload (AgentTesla)", "value": "de32e114e23cf733de64abb21ab9fa39491ef746313df88d8c5136e15d9bb9bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794422, "uuid": "fee10c8d-6b99-4fc0-895c-f4e655a54289", "comment": "Malware payload (AgentTesla)", "value": "1819f021ed37dba95595a8676beef827907ddd19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794422, "uuid": "2cd8cadc-d711-43fe-a451-b6daf6185163", "comment": "Malware payload (AgentTesla)", "value": "bd57244dd738e4634f3c0f3da47bc1520b27a1877662266f9ea8b0ed48ff9a2cbca12613f0ab6c260c2c5a091372d043", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794422, "uuid": "38db1edc-578f-452f-9e25-fcd564219074", "value": "1453A4111AB10993F71AF0BD4EB667B284EDB5545A63A4EF0FB483A86DCBF190187C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794422, "uuid": "08062707-3899-49d4-b9c3-39db64b3afb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794422, "uuid": "963c2cec-ba29-40bf-ad60-ef0e2419b3ec", "value": "768:hqsf49K00d7zGExUc3YLlgUcEhWcQCSR/+hLOKl3Ul3MhDePCXHLsZYhdFMLDSN3:8uAKdd7qCYRbSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794422, "uuid": "59f7d1a6-3bec-4c4b-8b34-8e17ca3f82a4", "value": 64872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794422, "uuid": "6b126b8e-b61c-4255-9cd4-1e1d488adaa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794422, "uuid": "bbb329af-e855-4fc9-ae7b-b921aacc6805", "value": "PO75773937475895377.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84609063-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774783, "uuid": "06dbad90-98da-45d9-8efe-d753a092c386", "comment": "Malware payload (Formbook)", "value": "568fa7becac49bd0989b0aace4ed86d0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774783, "uuid": "09ea2a50-b943-4a07-b266-f9be4d79dead", "comment": "Malware payload (Formbook)", "value": "df1f19f5e23dfa70466d8fc1df2ca5e699cdbe7a2c83e077914f4ec74445088e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774783, "uuid": "ecbffe49-8681-4c84-ae98-f78e208dfc2e", "comment": "Malware payload (Formbook)", "value": "2282f492e73479397e9b4dad22591961327f4895", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774783, "uuid": "f042fae4-0e55-4fa0-b2f6-90077c287a2f", "comment": "Malware payload (Formbook)", "value": "09af89468e4313d4e35e30e174d4a4d9613a541aa238c7729dfe5ba8882cde8a27a0f1539f45ce329f112a7bbd463935", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774783, "uuid": "eac89415-6e9a-4cae-a88f-74c2ece864f6", "value": "24B423D2786728EA0879E55CD8C06E831E547ED442219314836A99EF0E33FFBA5534BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774783, "uuid": "4b72a1a4-459d-4a0f-b6b3-7c4e935b951f", "value": "12288:N672iekugeF8T+AJNUvaHBt+KzQx+sRf0Vddu+wAWFNwv9K:NotekugB/+si+sOVddZwFrIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774783, "uuid": "64ea1b9e-b3cf-4df0-bd1b-f8944a89cdb4", "value": 536552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774783, "uuid": "959f6b9c-7f92-4e8e-840d-9fa5dd792681", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774783, "uuid": "237f8c7f-4a60-4cc2-aeb3-560a3ca4dbf7", "value": "B of L - way bill return.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5302e853-97a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617800040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800040, "uuid": "52245b4c-4e25-4417-b3a4-acd27718b877", "comment": "Malware payload (AgentTesla)", "value": "31dc788638f4b572964fbf2c9ef39afc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800040, "uuid": "234ab661-0b35-42df-b043-c470f86af13c", "comment": "Malware payload (AgentTesla)", "value": "df5e40d1e917f0bd4c424f65c8e2557d094f5eff22b4ba6f63f093333ebbb8a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800040, "uuid": "847f7c6d-ed16-4dc5-b4d8-f75f7051ca49", "comment": "Malware payload (AgentTesla)", "value": "9d213d02d92aaa1a3bb1c4fc80a900643d832a1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800040, "uuid": "c7484bd2-9368-4bb4-bdd9-f15ef40266a7", "comment": "Malware payload (AgentTesla)", "value": "2bd44af2745ab289990dc095b0cc2416b33c204a0ab2db08cd7e53fbc1f8c5a7a74b781a153da0699086a6df43cef7fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800040, "uuid": "667e2add-1b2b-49c7-b2a4-0cec2755370a", "value": "3305011167E88F94E43E273A0132A51013F2BC6EE736EA5D7DD871DD2973A0099B6B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800040, "uuid": "02bf5b25-9c01-4468-9882-33364390fd49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800040, "uuid": "d6203ddb-2e1f-4507-a186-e4f6aea31bbe", "value": "24576:UA7daZvqTDLPOiP247llQ0IKbYT02octUrf2o:UA7dMqTDbOiO47MC4oYc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617800040, "uuid": "0d7c63d5-4d46-49c6-83a9-478a89c36bcf", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617800040, "uuid": "0b271e9d-7230-4ee5-9ecb-9fc4ee46ba5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800040, "uuid": "c8de4241-552d-4dab-a4f4-0fc27d833887", "value": "LIHUA Technology (HK) order form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023361a9-9798-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617796469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796469, "uuid": "d6acb032-c455-4139-a5ed-b407f0700b5d", "comment": "Malware payload", "value": "31a5ed8d7088aab674e8182eae9618f4", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796469, "uuid": "070b903e-b779-46f2-8541-4926dac62b4f", "comment": "Malware payload", "value": "e0396d81c892e151a25484b56761d8b0c15a7b60d51d250d1fdaedb6eb9a06d8", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796469, "uuid": "68a93ad3-9177-4733-a18e-e80b018cef43", "comment": "Malware payload", "value": "fab0ee1bc550da2d0f75da18f2faf3ad6ca03178", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796469, "uuid": "a3b15c8e-60f6-494c-986b-7fc7ad5c43f2", "comment": "Malware payload", "value": "02da5c8386d6fa2cd939849f35bcb80cbce6539a83a25653b7f4462cd5d89e9a7a759035d59b3d72831a96d3a9822e19", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796469, "uuid": "87b9c062-aa9f-4243-919d-8ee9b59828a6", "value": "A763F71CF67AD38BC2140A3D4B8791E626283C519E8A72F631C437FFED36645B91E611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796469, "uuid": "86ce1518-81f4-4ccb-80c2-4fb9c71b12f0", "value": "192:lmpH47HsDODZkg4oi93tRD3AytaLEYdcHHLyYCJ6kymMa1WKl2lAl8l9wYtJd1CE:lIYXDZkgCHJ3Ayt5CJfTMa1Wp/Jd1C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617796469, "uuid": "f783528e-e1e0-48d5-a64d-cf69f20329f1", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617796469, "uuid": "bca1b83f-6551-4e0b-96bb-e1a25d49460f", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796469, "uuid": "516a7eb8-7715-455a-96a5-1000bc7e00b6", "value": "Invoice copy.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cd0bd2-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794507, "uuid": "8e886784-e95f-4508-a6f7-0cf8abd60ef5", "comment": "Malware payload (AgentTesla)", "value": "6c2d830b0a2ccb22af19300af06eda39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794507, "uuid": "1495c9ae-770f-425c-a76f-f78873a51f94", "comment": "Malware payload (AgentTesla)", "value": "e122e45cffddf06da2e9b03d259b27cfc77e78f8e0f3d047dca47975a5f81687", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794507, "uuid": "9ad79bce-9ad6-4bb3-b3c4-b8a04e831cf3", "comment": "Malware payload (AgentTesla)", "value": "5d5e1b60459e4c6a0745b4b22075b901e28e0c54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794507, "uuid": "4b6169f8-0f93-4ad5-80ea-040deef1870f", "comment": "Malware payload (AgentTesla)", "value": "3800bff77d57ec2e2b8bcf8b33d29b99c087dd6c55d4e10cd53b7ef88f518a825acba1de138d1a495ca48bcd68d02055", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794507, "uuid": "0a7d0898-3139-4f0f-9301-cbcded5e416a", "value": "A515E02B775C6B5CC34C4B72703A4AB862E49F037166DE2E74C9FE9C4E2221E57161E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794507, "uuid": "10a271d4-d3f2-4acf-86dd-12ae80ce15d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794507, "uuid": "f01c88ee-d38f-45d8-9028-0c580dace180", "value": "12288:XoSnyElpIV1Fn6OAVo1TJ9Nxf10WwtfzpzY7n4NkySmwyk67Kd7Z5:XTy65o1PrL20MWZ/67K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794507, "uuid": "fdc3f34b-1275-4a97-8a9a-bb360722d219", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794507, "uuid": "b7216b49-a1f9-4c10-8afd-84b80fefb406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794507, "uuid": "4fc5df74-2557-47a2-8848-974e9c307c96", "value": "DHL_Express_Shipment_Confirmation_BKKR005545473_88700456XXXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6c9867-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617775201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775201, "uuid": "671ccafe-a5cd-4d7f-ad06-9840bd0a7591", "comment": "Malware payload (Formbook)", "value": "b1f71045eff99bbdc181370889664581", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775201, "uuid": "07a274fb-a823-4791-bddf-f5af6990a285", "comment": "Malware payload (Formbook)", "value": "e2054a668969a178ed46aa1de4630da4d397bd2cdb0cef98d4cabba80403ed08", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775201, "uuid": "77e0318f-2e41-4df0-93e5-047f49526723", "comment": "Malware payload (Formbook)", "value": "eccf0c55a61b387a6ac6245a335951228898ea7e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775201, "uuid": "507caa71-1101-4211-8fcd-992fe50c7bba", "comment": "Malware payload (Formbook)", "value": "b0cd26c13ee4a2459dd2ab43bb7a151cb74d9f159f9c1867372a4d4e86a55dac3a38584ff8a713a280d06e5540b45260", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775201, "uuid": "f20edd95-f8b4-4866-82e8-4a50b962987c", "value": "0705233BC91DCB255923E9FE847030763750B20E26371C675ED3A02D9A652A4686FFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775201, "uuid": "dbe5c53e-ebfb-48af-a10f-fd519fffbd29", "value": "24576:5uU57hzSGF0GjzWMzX8htFwge+UB0DnixgDhb:5959eoxeyXKwgdUBynv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775201, "uuid": "7aa5e3c4-f107-427c-8c4e-3f7bf8c9e40b", "value": 799341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775201, "uuid": "722e08a3-8920-461d-84ee-1c7819a911b8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775201, "uuid": "42527cc4-9b02-43a8-b44b-fcc1ebcbb05c", "value": "ORDER6798ERA-LBT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431cdba9-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617794430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794430, "uuid": "7e6d62be-1613-467a-8255-514e89319dd3", "comment": "Malware payload (Formbook)", "value": "5298c4e4910e765377976a038d846ea8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794430, "uuid": "d8977dda-8f5e-409f-a8ff-6fc6797f1da0", "comment": "Malware payload (Formbook)", "value": "e2c5bfd23304888a6f7fb4ec5f45b2f3e51bd411297c8d5c38fd010640af610f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794430, "uuid": "ba7bc319-fb5d-4ab2-84db-b8aeb02ce12c", "comment": "Malware payload (Formbook)", "value": "1e37c43de6a1046d22e469ffa1c95ed90d70b73b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794430, "uuid": "6132605d-b6d7-48d2-9e8a-e0574818eac4", "comment": "Malware payload (Formbook)", "value": "a1abd1302ea2435e9af5755204d3d73bf86ade56d1e3ed459d94a9c57b1805d08c5a964a9b78f71d0aa1e31d703e31f2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794430, "uuid": "aaa80ce6-a5fd-4d70-b7d8-c13d92717d0a", "value": "ABC4234B080BBFCA1C9DDC5572B91857AB1E33ADA5A2B778FE3500458030B167C6FE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794430, "uuid": "4a7049f6-c5a9-4b82-9d30-fb293b09f3e7", "value": "12288:uKgL/i+EceQ+t2sjZskVs4vDMBRa8Kbk/CrU9u2CY0nRc3C:u/L/7Ecep1fQBArbUwU9ubnR2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794430, "uuid": "6c3e7d74-5c6f-4c46-86f6-68a771ec1166", "value": 567685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794430, "uuid": "2f07618a-7d8d-41b2-a826-071160f0de61", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794430, "uuid": "3284a618-50a1-40fc-a8a4-c6c911524de1", "value": "Order_April shipment.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b2f428-97d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617823835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823835, "uuid": "ce90b9c4-a468-46b9-9709-bbfbe75c0600", "comment": "Malware payload (Dridex)", "value": "28aca00f3bdc6b1f04ceda781d301d49", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823835, "uuid": "a4eb181d-24c0-4e21-a84f-3a6e09505c7f", "comment": "Malware payload (Dridex)", "value": "e38c371fa2815cbeae6ede0a0b2724f5bcc59b7aff5c8dfbba3e8f2a62c21528", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823835, "uuid": "c11ab901-d8b6-4929-acc5-b8fd37d8f7f8", "comment": "Malware payload (Dridex)", "value": "b80c469110c520000cd9340ca1cfc44e67bb38df", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617823835, "uuid": "fcd40cac-3e8c-4183-b272-5184f82aa4bd", "comment": "Malware payload (Dridex)", "value": "c060ebac6e4d27d078dd8a2a7a8692f8a4deb214e31a7be85bab0a40fe249c22dae160f7c5c7d93889047b746acd7482", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823835, "uuid": "c44c3190-3f9c-4c7a-aea1-bbf0eb91dc27", "value": "1714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823835, "uuid": "a5f0afeb-eaea-468d-889d-d46430468b60", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823835, "uuid": "77446bcb-fe1f-4655-87e7-69a3db77f55f", "value": "3072:zBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:zBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617823835, "uuid": "1d7232ea-4e7d-4742-89b5-607290cca2cf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617823835, "uuid": "cfa4acb1-f77c-43c7-ae39-9f824c465a44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617823835, "uuid": "705f982f-144a-4e26-82b7-c630a225a93e", "value": "e38c371fa2815cbeae6ede0a0b2724f5bcc59b7aff5c8dfbba3e8f2a62c21528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32c2fcf-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617774915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774915, "uuid": "795dbb5d-f83d-4161-ae95-d89c5296cb9a", "comment": "Malware payload (NanoCore)", "value": "dc8e7cde980f05501758f8ce3048682e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774915, "uuid": "f5780be9-038f-46ec-b638-9d4fe422950b", "comment": "Malware payload (NanoCore)", "value": "e3b80db58c1fa79c3780e68cf7d3ea987fb2615a68077ba3b110cfd3a7cf4de6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774915, "uuid": "cbac3a32-9a2b-44f3-9d5c-36e042ae713b", "comment": "Malware payload (NanoCore)", "value": "fca9c2a66cfddfe6a8677e1568ea32ad18dda600", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774915, "uuid": "aafdc244-96f0-4fc6-891f-c69ec74756f0", "comment": "Malware payload (NanoCore)", "value": "6860edc0ac0f9980bb1afd67ed790fceaa1e878e558a564ec71c025ac2fda53bcf76eeeb85c947079845baaa5609b047", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774915, "uuid": "54a99b72-b21b-47e3-9add-50079637be51", "value": "398363952BFECF71AAC514FC3B993664305BFF0035216D3B9D6D2194ADC082963ABC68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774915, "uuid": "03fd1e5b-5646-41ac-bb23-56ce7c2ae208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774915, "uuid": "ae284966-41f4-4dc4-b6ec-e2888c3560a9", "value": "768:DVo9K0V0z/hpL8dKKuzVczbeso66z0Rb6eQxl8+to23I9aFhVkSdM2VhY:DOKU0Dhp7HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774915, "uuid": "7a954acd-51fb-4481-98f8-ca53ef153105", "value": 83728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774915, "uuid": "ea872a88-1fbc-4428-922d-2ce47903d8a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774915, "uuid": "ffee93f5-b011-4287-8861-a2c4573e4146", "value": "DHL_document11022020680908911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a86221-976b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617777260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617777260, "uuid": "d782c7ca-34a0-47be-829f-08b7d016002d", "comment": "Malware payload (SnakeKeylogger)", "value": "438fd6dbab8d1248eb8a36e91003bb6f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617777260, "uuid": "a7558aa8-acd7-4a18-a662-73c31ee17faa", "comment": "Malware payload (SnakeKeylogger)", "value": "e427d1bb1bd411677b680ec5414b2b778f3eb3963b3f51bbfa9d1009e6fbe672", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617777260, "uuid": "147f4208-c059-41ce-a84f-7e40664c3b0f", "comment": "Malware payload (SnakeKeylogger)", "value": "65dd70fc7a17109921a6bf64040011937005aaac", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617777260, "uuid": "b06871bc-ac35-429d-a2b4-6d5b4332b9ce", "comment": "Malware payload (SnakeKeylogger)", "value": "73e10429ea2424590abaf2a7aa2a1b9d292db315254ec1c2ff19b9913ef9a1f98d8d00c33ace8cb11f9c24185e43d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617777260, "uuid": "e67c48e3-71e5-497d-8f01-ea2f11be322c", "value": "A235E02232989B96F17E5B329465913013F1B84FE376D24E3CDCA39C16B2BC1C25A776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617777260, "uuid": "78184405-ff44-4391-a3e6-63f079feacb7", "value": "24576:w3bOx1cDn3DmS6pUb4aoaJ3IkPNYX3YGJuvHUzvvCOOReYycnlWp:Nx1Wn3DmvpI4aoaDPi3pJ9v7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617777260, "uuid": "76182c4c-30bf-421f-9776-9abc9607ae22", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617777260, "uuid": "209ff986-8183-45ee-805c-398d13c63c8b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617777260, "uuid": "1263ad64-c04c-4aed-b976-498919f893f4", "value": "Yeni siparis _WJO-001, pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ef4de1-97d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824131, "uuid": "31f7ad84-025b-4109-ae42-2d3f7631b608", "comment": "Malware payload (Dridex)", "value": "c802022c6acc2df1319c762843329926", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824131, "uuid": "defe0b5e-146c-4f20-8a8e-9941ca91f137", "comment": "Malware payload (Dridex)", "value": "e4bf026ebc5952624bbeb9c3bbce0bfd9723d3c3a3c83fd248bcf7a17ae39219", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824131, "uuid": "a3f77077-c13c-4b0d-b820-018c3e197151", "comment": "Malware payload (Dridex)", "value": "d9e16015dc7a586538bdb9d8219d58ccc772c4c4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824131, "uuid": "d5c623d6-a37f-43d7-a299-32a3bfa4d1df", "comment": "Malware payload (Dridex)", "value": "04a3b80670e27569d5afb4eebfd76d1d8a4a96d16865e200e46e848a6adb5da6b39aa4b7a2e0185a1ccf05cc11bf3481", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824131, "uuid": "e482e8cc-d2e1-4c2c-8fbe-0bbd748a20dc", "value": "1C249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824131, "uuid": "a981edf6-1931-4d74-a3e5-02e4e0354172", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824131, "uuid": "45b51a04-14f5-4bde-b29c-9f128f431816", "value": "3072:30DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:2pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824131, "uuid": "03bacd67-b45e-4c67-a346-aaedd61fc7c0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824131, "uuid": "5389c2da-ecb3-40ef-a89b-c856a2ad3b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824131, "uuid": "da87a487-de4e-4523-b8ab-101d60eff25a", "value": "e4bf026ebc5952624bbeb9c3bbce0bfd9723d3c3a3c83fd248bcf7a17ae39219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1a0f79-97bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617811976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811976, "uuid": "79abcb5d-4adc-47c9-9b33-c02b93c491dd", "comment": "Malware payload (AgentTesla)", "value": "e59504d73ab4e8862d3cf857acc9e589", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811976, "uuid": "6a810ecc-3cd0-4bc6-96fd-0af7b36f9ba0", "comment": "Malware payload (AgentTesla)", "value": "e503e03ff1c7d476a6e8ff312d759d1cf2557a20589a8bd67ee6508fbcd9c279", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811976, "uuid": "db2ca6cc-c2b1-431c-922c-421b5148daac", "comment": "Malware payload (AgentTesla)", "value": "4957cc9e423659b392dd588b79ccf035d49b29d1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617811976, "uuid": "2f1f798c-781d-4bf5-930e-e143729ad000", "comment": "Malware payload (AgentTesla)", "value": "5669a4c073c95abb2d6d6826c0b71115f817acd02958c4c8ac7c02a9b9f98e6bd38c9be761d643b7592db9e8b2b8c534", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811976, "uuid": "1094a3aa-757c-4d12-a178-ce837ca21b8f", "value": "C90523540844A0634FDEF8CA364C887731BAD6CE15776FC3E52BE1B8EA47B1C62966C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811976, "uuid": "f476e1cb-178b-48f1-9502-c48d48bfd609", "value": "12288:kXSjlY9JprZmYeqS/XTs2AKF9YNRW66mqpl70jJe8hBQa0oYtgppTVeW/qYjHo+L:kVp9muSfTTAwKG66fYJhSa0qpjHqCIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617811976, "uuid": "45933c88-402b-4970-9db9-5105f312ab27", "value": 796991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617811976, "uuid": "cc47b961-9bac-46ec-9366-b684d927bbf6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617811976, "uuid": "2cfcbb6d-6eb9-4394-9e31-28da99d19604", "value": "Overdue Payment_USD.106,375.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46df510a-976f-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617778975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778975, "uuid": "12dff580-8349-4724-a31a-820e5da2b0d5", "comment": "Malware payload (njrat)", "value": "43f39aa29cd376413bee0dbfbb437739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778975, "uuid": "11c6d30d-dde2-45a7-b475-37c3db0d47cf", "comment": "Malware payload (njrat)", "value": "e58e300683428c82bb153aef9a07569d10dcfc09b389a6971c31b7e1545a3276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778975, "uuid": "3540b774-f752-4e71-86ec-8f6a48d0a879", "comment": "Malware payload (njrat)", "value": "8dee086e7e2d7cd3661079bbf06ea6f0837f3dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617778975, "uuid": "e35de0db-5ec7-48d4-81d1-a3120a5ef18f", "comment": "Malware payload (njrat)", "value": "cb2a849c0ee2bff82eab6d4f6e48ea1db86d76a84e4c5d6784208c4195aa92ec3a5cdd01680b41768ee3a93345d0ed75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778975, "uuid": "061c6f7c-7ca5-4231-9e66-436cbe48916e", "value": "5FB20A4F3FA98866C57C177486A5965003B4A1870423EE2FCCC564CBAFB3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778975, "uuid": "c5cf2d70-655a-4f36-a74a-0d096a710346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778975, "uuid": "f66078de-b141-463c-aec0-c648590dcd4e", "value": "384:6cqbCK0l4h7o9SVyDGvENuh46JgJkOmMSW38mRvR6JZlbw8hqIusZzZU0:930py6vnxaRpcnuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617778975, "uuid": "59911a71-de01-42cd-a0fc-d5dd2e88bbf8", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617778975, "uuid": "1e33f0ae-f2b5-465d-b32b-5c7bd039044d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617778975, "uuid": "5efeb900-4ff1-466d-bcf5-02c6cbfc3279", "value": "tmp2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855c9a46-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774784, "uuid": "c87b94b6-8567-445b-8c07-03ecd610298f", "comment": "Malware payload (Formbook)", "value": "4aa31344c11a8bf34ea047ebcb352b35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774784, "uuid": "d3dbf916-87cd-49cb-966f-413fdbe0501a", "comment": "Malware payload (Formbook)", "value": "e614d735f9fb59c6c21cfed37a1177fa6607684c1ef6be58707b517c96407462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774784, "uuid": "9769d2a3-0eb0-4901-8628-75da41f39813", "comment": "Malware payload (Formbook)", "value": "b1f6ee22c7fae2c38d2ae339f5bf12d3e1d7ff37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774784, "uuid": "becf8fea-7617-4aba-8150-ae614305613d", "comment": "Malware payload (Formbook)", "value": "70924f68ab156e9b1d53cd9e5c3a558068c806d1081f0040a589eeaced7c1307a6c610eea2c6341be7f647c150ced7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774784, "uuid": "c4834d7f-8df1-4f73-85ec-d1de41dc06b7", "value": "CAD4DF106E9501C9D4EE36F91821808007BDAD167BE2F74DEFB075A95A72A33CE50B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774784, "uuid": "56ccd30c-4ff4-4358-b7f4-457f87235121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774784, "uuid": "4bcdb9e9-8c3f-41a0-94cf-da5fc65dce45", "value": "12288:gBLSkQE6W8YTCscyFPSxFr6MQHsIizLWMYs+GPlFXLKuea:gckQE6RYTVNFPQFrhcuSM/ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774784, "uuid": "e73e0a88-7c88-4930-b4e6-a25bbb62c51f", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774784, "uuid": "894d64e6-83a1-4204-8e1d-8b74a6298479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774784, "uuid": "8d5cc4c4-0ed3-435a-81ef-2bb456099757", "value": "B of L - way bill return.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82068ca8-97f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617835338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835338, "uuid": "296a311b-260a-46ad-8903-7e265aac82b4", "comment": "Malware payload (Loki)", "value": "8204a45dfc64cb28c3674ca1ee7d1318", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835338, "uuid": "683f0ed3-8dcb-4e3f-8164-70ad6f92cc4d", "comment": "Malware payload (Loki)", "value": "e74afc27b5ef87888f64c9bb4d793b4f2739c0005f3881eae37f626a5650be0d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835338, "uuid": "443d7640-5e1f-4269-ae43-4507f59c65cd", "comment": "Malware payload (Loki)", "value": "cb09492e4c240aa321e30ddc9e4715f932d43738", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617835338, "uuid": "5790629a-f8a7-42f8-8d08-306a13629e6e", "comment": "Malware payload (Loki)", "value": "8a2c31b1d8615569ad80f10fe0549c6ec5b6214c0aedcc1b4a8ceab748d2280a29997e071c4cecfe097c1dd603e7c490", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835338, "uuid": "aa3cd28b-2c5b-46ef-931c-9d126fe3ca3a", "value": "95F3E112BEC09DE6DA5316705876EF2A826BAE080477854BBB4E3F5B54B3353813F14B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835338, "uuid": "1a3be035-6baa-4918-a0df-a69f827231cd", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835338, "uuid": "f6913c1c-b555-4783-8743-8934236874a9", "value": "3072:peYBCwqDxkJY3vfdHldhwR+OGa0AKttZYSma/pccKgqX8VivuRviUrDfmNL0:pDILfYSZccKUIuRviUryh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617835338, "uuid": "152ebb5f-06c1-4c4a-8a08-b99fbd714817", "value": 170722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617835338, "uuid": "a1a77280-ba9b-4618-b61d-f8a320bad20a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617835338, "uuid": "1fd772ca-de95-45c4-938b-14cbb6b17ea2", "value": "loki.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1d7ed8-97b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617807166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807166, "uuid": "6577483f-a412-42ea-a1c2-c18405345157", "comment": "Malware payload (TrickBot)", "value": "58dce784a93abeb2b6b462d1a75e9e8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807166, "uuid": "e13ec1d8-1bdd-4dcd-9563-10e10d729ace", "comment": "Malware payload (TrickBot)", "value": "e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807166, "uuid": "03c55aa1-7994-4d66-9cf3-9698889145d8", "comment": "Malware payload (TrickBot)", "value": "da2e6c939259e4435a335b360398cbff7a6e3ffb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617807166, "uuid": "4304620a-9542-4fb6-bbb9-abf32a71aeb6", "comment": "Malware payload (TrickBot)", "value": "7435220fadfdef776202671d5d70321d07e04612fb57e0f30a0ac387e1983777d181bc1bd0f8a40578acd97f4cbe53a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807166, "uuid": "89093579-404a-4e58-a51d-08650a7e4589", "value": "FD15BF1231A0C176E2EF02704A16AF7972F5ED208F7A65C3FB804B6D0D779C6973A166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807166, "uuid": "00744909-57dc-440c-ad47-5872a2cbe116", "value": "0a018560a180590f4385e7ef8943a2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807166, "uuid": "f75b204d-c28d-4247-8343-08f6b57ec8b6", "value": "12288:HZA7fTLrsLYD3Hy9D2s/DSmfxSVp4D9RLb3ZIX83uRq:05DXy9DTo3QRLbpS832q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617807166, "uuid": "cebd9ce6-37c0-43c7-a430-7442b0d35235", "value": 884795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617807166, "uuid": "7e1102e9-9eea-4ed4-9d9d-6defbec8fd4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617807166, "uuid": "bdddb093-5aab-469b-8705-6bd373b3ce33", "value": "58dce784a93abeb2b6b462d1a75e9e8a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbb8904-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775198, "uuid": "84dd1b15-d403-4f74-9122-a92a415cbba1", "comment": "Malware payload (AgentTesla)", "value": "03d9f7cf01d3c7609bb269abd38b657b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775198, "uuid": "9e9e0c74-d807-4c53-81a9-79427ac1382a", "comment": "Malware payload (AgentTesla)", "value": "e889d6dd8614cb0a6ff70e130c651068e04dce0f1694f7a16251e304d35d27d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775198, "uuid": "636840db-f2b0-418f-ab0a-5586e18a9ce3", "comment": "Malware payload (AgentTesla)", "value": "17b34918e3b898d97306fa6940e5560c8a73ae25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775198, "uuid": "341357c8-fe33-4c7e-9ab6-de6b96e1d278", "comment": "Malware payload (AgentTesla)", "value": "dcdda6356499ebcac80ca5b864283f457aaa9a368ff21ee7c1f2d69d1121721da5e56e56aa2e72f8d245907c29b2ff46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775198, "uuid": "8600f70c-bb9c-42ef-b767-15a63ea31e77", "value": "84F412313948C557DA1E0B70D86881F957B2FC55EA1A06C77CCCBFBFBB3A6542206298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775198, "uuid": "362de829-c698-4b0c-a034-25233a31b54e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775198, "uuid": "e3826e6a-fcba-4194-804d-d04475553268", "value": "12288:JRVTKiBGtXnZeGU1hmyOiyCyYP2Dm/KLfrTn7xBeevAdk2/:9uXnK1kyOvu26/if/nlvZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775198, "uuid": "ae63d7c5-587d-4b91-924e-00481877d60c", "value": 741176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775198, "uuid": "cc66696b-b562-4eee-bae4-e44ebf14cfab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775198, "uuid": "2ac7448d-3bdc-4183-baec-112972a8c6ee", "value": "Outstanding invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f43dba-97da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824829, "uuid": "fc48702d-5a5f-4200-9621-b3bcf2a07e46", "comment": "Malware payload (Dridex)", "value": "8f399da4c9cd6a574033876e618a6c5e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824829, "uuid": "b73d3fa9-d6c3-4ae0-85fb-ba315ad2d634", "comment": "Malware payload (Dridex)", "value": "e8fca7c028ad4da757da4af8a70b656ce093b15248763294b07cf111f3c26e58", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824829, "uuid": "ad1cd672-e9cb-4875-bb7a-6691d241e7ae", "comment": "Malware payload (Dridex)", "value": "3d6fb0c2ba5714520500219aba88fdc8d0e361a8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824829, "uuid": "bfd131eb-71d4-479b-99f6-d2e458197990", "comment": "Malware payload (Dridex)", "value": "01fe846094eaff3e03e4d890d759de5c9d22bf51d8bb050a48456c9e55374f0b387ff9ef854cf35817c6c2609ace76e2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824829, "uuid": "86924f8a-19b5-4fa3-90bc-ff068c47cd4d", "value": "30249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824829, "uuid": "71918f9d-5c21-403b-8135-f7abdb03d422", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824829, "uuid": "974b7b14-33c0-4beb-b4a6-ac94d5a00d0e", "value": "3072:e0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:9pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824829, "uuid": "f3ca0ba1-4f64-4c3b-bc2f-f39887c2b036", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824829, "uuid": "f5f1a1fb-bb14-4a57-9be5-de3e4c37f724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824829, "uuid": "ec1ce91d-2429-4e11-9789-ce563920a0ed", "value": "e8fca7c028ad4da757da4af8a70b656ce093b15248763294b07cf111f3c26e58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ee8ccf-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617774816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774816, "uuid": "eae121b2-6a75-4389-847a-55ceeac1f735", "comment": "Malware payload (AgentTesla)", "value": "6cc5d04f6f11b8d14e05184af6f19668", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774816, "uuid": "eca5d28d-a05c-4c64-a2f0-9bdb55eeb03e", "comment": "Malware payload (AgentTesla)", "value": "e9cfd1c6ec2440f901e786a33478de70fd090e1e9dc9b55aedba8fce5b2a4d50", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774816, "uuid": "29c20a14-8dea-47b1-850d-e74850d75d92", "comment": "Malware payload (AgentTesla)", "value": "0866f867a6db703613100013bc0aa7aa0061f766", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774816, "uuid": "0e3a9905-3970-46f7-981b-3488bfdf3de8", "comment": "Malware payload (AgentTesla)", "value": "0a2f53d62c1d5eb43b936063b4f5828cceab98d3cc7a5ebae41ab768fc7b53fffdc6f94621b98ae31246daa87f82912c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774816, "uuid": "a835ccb6-11de-4b03-9350-55d7e56beefe", "value": "A95423FE195042C2442B391D463234C641CED61156247F7325A4076EBEF2B7F4AEED6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774816, "uuid": "5d70d8a9-a021-4b74-8aa9-894c64b1d680", "value": "6144:Z0NmXh0Ov+RpsEUIf+CcPBkCO/wOUcF06TqBn9ogJ3UU16cBLewggKTzOIs3:ZKmXh0OveGdIHkcxUYWB6cz1lqw1GOIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774816, "uuid": "215ab9f7-2940-4bba-a3ba-93fb5eafc2a5", "value": 291638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774816, "uuid": "45e71151-98e3-40ca-8916-9b6fd189a2bd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774816, "uuid": "cfea2089-bc84-45f7-8faf-64092e0c946e", "value": "Thalesnano.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba11c613-97d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617824695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824695, "uuid": "98896b54-9471-4279-8daf-b58d1d90fd07", "comment": "Malware payload (Dridex)", "value": "acc8d030a7e07acae2206cf678730374", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824695, "uuid": "5dc84327-fb0c-4d06-884d-6aa3ef0db9e1", "comment": "Malware payload (Dridex)", "value": "e9df3ce020c4900c177c3584e1477c1f007acf9d39e2d92d1fa3f3a3c24622c3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824695, "uuid": "d29de20f-ad47-45d0-be7e-3209f1de23fb", "comment": "Malware payload (Dridex)", "value": "9d29110bebfc77cad33ec859116b7a6c654fa2d8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617824695, "uuid": "793801a6-233f-44a7-b63c-ba45daf02016", "comment": "Malware payload (Dridex)", "value": "4a89706c869f81ba403d801fedfb8a393e723d78b812ed87846dca41657a69a4822c298394f5b334f54825d61903b6ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824695, "uuid": "1ebef90d-b4a1-4dee-a9d9-51ab976483cf", "value": "4E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824695, "uuid": "5b785a6b-8626-4f4c-803f-caf34450c6ed", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824695, "uuid": "ad3997e9-46a3-41c3-b0b2-f6a7580c7d4a", "value": "3072:00DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:/pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617824695, "uuid": "74c600ca-f94d-4388-b3be-93a4e0c559e6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617824695, "uuid": "9e3cd3bd-788b-4849-8d6b-158fe53815f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617824695, "uuid": "08d8a3ad-8c80-4674-acd5-cf931aa476ec", "value": "e9df3ce020c4900c177c3584e1477c1f007acf9d39e2d92d1fa3f3a3c24622c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f301345-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617775204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775204, "uuid": "6389aa2f-784e-4399-bbbb-8877d90b18a6", "comment": "Malware payload (Formbook)", "value": "ede289307c94dd928758ea965d49e977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775204, "uuid": "6d6de8a7-6fc1-4364-9f0e-7e3edb9b3831", "comment": "Malware payload (Formbook)", "value": "ea1dfb8b4d49ed0725305093b1a5466d5ab339ba2a5b125db5f3b87c42b874ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775204, "uuid": "b80d199f-dd1d-463f-84f6-d74a455b2551", "comment": "Malware payload (Formbook)", "value": "9367ab312dffe1ed08eca19be7d535108f66350a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775204, "uuid": "fecd337a-3ac4-4d97-91c5-1cc5affd9ad4", "comment": "Malware payload (Formbook)", "value": "0bd6fadb91f740e1fdb35f855520bb55ea758b592053b60f7e49f22d8f269d970960be8cb7f9b5f31822e8aa2c59b491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775204, "uuid": "41ec7ccb-1177-4b01-b4fa-e92aa63e130c", "value": "5425F02226A56F24FABD97799460007053F6FD47B331EA8E3CEC7D887531AC0D6127A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775204, "uuid": "e542fcca-00bb-411d-89ff-4aa03fc7894e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775204, "uuid": "c4509e95-d2fc-43ba-a67d-0eb75af37b08", "value": "24576:nKbR/1gDnqQOQVdXVACtxJUeLw14JT2J3ph4bLtPHSDLU2:a/1yn9VjAEJUltRpabLVHSDLU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775204, "uuid": "746da914-2cd9-41ca-a9ff-2b3397c1dd84", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775204, "uuid": "13078208-a555-4de7-ade5-5c1509907e9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775204, "uuid": "9c6c83aa-90e7-4d97-bf3c-54d05be911db", "value": "ORDER6798ERA-LBT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f643232-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617775258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775258, "uuid": "870220e1-bc21-4604-b235-1e720b059f65", "comment": "Malware payload (AZORult)", "value": "50bef5bd8f8b1322114a433ede7834ac", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775258, "uuid": "b8e37653-37cc-4cc6-b0f6-64a3767ecce9", "comment": "Malware payload (AZORult)", "value": "eb5af57f681421a21e682dd8adf47644803649b467f4f8da53f14de2182a76c7", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775258, "uuid": "caa56263-6016-4365-bc18-82081c24da0e", "comment": "Malware payload (AZORult)", "value": "e2beb1f02ee5b80abbab8f01c2b107fafec35362", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775258, "uuid": "a23cdd75-3d36-48ef-9635-c3972c95d296", "comment": "Malware payload (AZORult)", "value": "72e56ce420d9a666d6096af42bbd75b518be63148a138f8c984ec930263885bdc620d84f8fb5d01ab2ea38738c0f4957", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775258, "uuid": "e27be625-c65d-46ad-89dc-6741f8e0871f", "value": "6A5397E1DEEADB66C5E6513D50D825C81AFE71101C938AC622EC17E0B7CE0E541BEE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775258, "uuid": "4b50533a-4a26-4ac4-85b9-0cbd212d6703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775258, "uuid": "793bb259-175b-4f07-a74b-5fb3b003c0d1", "value": "384:adefJLDQDL9K330XtUgS39/crn+slBY6TZnZuZrgTSN9WL+FYM/3R3KfPnWVepMb:gILD29K069Er26PEeh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775258, "uuid": "437acfcd-aa1c-456d-8ea4-ee4fff724812", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775258, "uuid": "10ee2be4-78ee-4fb8-9e87-582c12165a06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775258, "uuid": "9330d2b2-9c06-4a89-8914-785efe25e7c9", "value": "VMtEguRH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c219e24-97d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822497, "uuid": "949831c3-a780-48f7-a04f-1b06bd734b8a", "comment": "Malware payload (Dridex)", "value": "89cfb63ebd5cf43b22ba0c8deaf4216c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822497, "uuid": "fd740314-ce4b-4ea2-ae68-35ecdc940a14", "comment": "Malware payload (Dridex)", "value": "eb65996a097e087926da34dddac20a4811ffd3da8cbca3fd5718fb263d38b312", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822497, "uuid": "bb3c92b0-316f-4bea-8683-e8111f4f101e", "comment": "Malware payload (Dridex)", "value": "c0cc22add00749c6cd99ded4f6c66fd9d1c762b4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822497, "uuid": "f17a5b85-3b7a-4f66-8964-fd8043603b0c", "comment": "Malware payload (Dridex)", "value": "7f9c53a2350e4c34d0ecad15d18a1cd6785056615a29ce8616f35021d3497992fad5c0f0720348f71a647c4ae1a22f26", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822497, "uuid": "2393bcda-0e6d-400b-b40c-e072f224a052", "value": "0014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822497, "uuid": "deb1ac50-d5bb-4528-94a6-8aba094ee47c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822497, "uuid": "8de20990-dada-4b77-bdbc-010f0f33f173", "value": "3072:NBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:NBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822497, "uuid": "e2ce46f9-1d78-4cc9-9c56-da245d477f1d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822497, "uuid": "8bb3e9e9-4d6b-43ff-89db-8f61df4d4a08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822497, "uuid": "67662968-80ca-46e1-b928-3b9617782577", "value": "eb65996a097e087926da34dddac20a4811ffd3da8cbca3fd5718fb263d38b312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67225bca-974d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617764426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764426, "uuid": "ac5aa659-282a-4970-8125-d7ecae40c2f7", "comment": "Malware payload (AgentTesla)", "value": "f02f10e075dc9be2baf23ee856fc8cad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764426, "uuid": "88b848dd-b224-4c50-b449-63a58f9c2a84", "comment": "Malware payload (AgentTesla)", "value": "ebd059221fd6663824e281fda56416039f44fcb51d41d323417029f9bd96d73a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764426, "uuid": "704559de-8ad5-4428-aedf-729478617f67", "comment": "Malware payload (AgentTesla)", "value": "13f3cf93d05720be4f4226c65ff9eb29b1de06d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617764426, "uuid": "42815c87-38ee-4ac8-95b9-e88f239c709e", "comment": "Malware payload (AgentTesla)", "value": "440de31cc9fdeb520a3332c3d4df9ece6622b46c6a002757e9df2c2f85b280793b074e0aa71cf1be2ecb4a2e30e117b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764426, "uuid": "e6e35b22-7287-4905-952f-cd843a580e7f", "value": "5305DF296E5868C0E4EE3AF248628480527DAD067BC2F71DEBF035AC4972677CE5171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764426, "uuid": "2266c602-de9f-4b72-af4a-0327f6bb4106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764426, "uuid": "9315092a-af1f-4ede-a8c1-572c95efdee9", "value": "12288:SN2+3TwfLzNhDH+Zkc7n2LhITBE4luVUWb0wr0ccp1UCvsSaNELBO:F+DwfVhqNohaLluVUa0ccZ5aNELBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617764426, "uuid": "a959e04d-61b3-4a8b-bcbf-58a275b0ca24", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617764426, "uuid": "e92ec7a7-befa-4f0a-9a85-d1d23c3b480e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617764426, "uuid": "2c945b82-194b-42fa-90e9-d885b5b64377", "value": "DHL Delivery Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bc3ec3-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775238, "uuid": "da03f50c-32a6-491a-8f4e-6ebd59bdcba9", "comment": "Malware payload (AgentTesla)", "value": "b491ee3c9752d540244c24de39aa2690", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775238, "uuid": "ec1627d8-1bd8-42e7-b4c4-5930c3c6eb81", "comment": "Malware payload (AgentTesla)", "value": "ec09579076428b4e788722563b4b768eb0e9f8c75d70aa3cd5d9866a40ebd171", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775238, "uuid": "75cb1921-4be0-472a-94c9-e31592f21982", "comment": "Malware payload (AgentTesla)", "value": "f88c8f80e8e0c26a917891c82c8a6300aabde8ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775238, "uuid": "bbc47809-a2c7-4675-8375-06d42a9c41ff", "comment": "Malware payload (AgentTesla)", "value": "486e26ffae9989ea51182602e2d8ab4a24b45040f215fe3afb581fdb6b33db889331af5e132de68bf422db4229ac7bb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775238, "uuid": "6c69623a-d1c5-4468-aca8-592666fe69e2", "value": "F4C512E16B82CB91E41502B1C51281634B13FDFDE80F86D62501FE162D7EA8E6DDAEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775238, "uuid": "0aed2ee9-8bb4-432a-b847-2022899d27ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775238, "uuid": "0b400008-6b98-4a58-832c-eefa9743dc67", "value": "49152:qwllKh5PlK29V+tKWX52bvikXjHVnw9UUg41/LIioyfqWpqm7mzbwkjGdB4t/Gt+:ih5PQ8V0K+oGKjHV+Fv/siBSW8DbwkKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775238, "uuid": "93acc18c-db4b-4eba-bd0d-50804d2cc952", "value": 2620416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775238, "uuid": "d624bf8d-be48-4dac-ac26-e67ada2a8cad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775238, "uuid": "899c8c64-7119-4993-88bb-b3743d1e7dfb", "value": "POList Order == Xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07da8bb1-97ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617805068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805068, "uuid": "df76cce8-1f8d-4b4d-8521-be17e0499b6c", "comment": "Malware payload (AsyncRAT)", "value": "58d8d9cacade7c05b3858dbd716d867f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805068, "uuid": "e11f9de1-60ff-44f6-aa4a-869bd6b18fe4", "comment": "Malware payload (AsyncRAT)", "value": "ec2bedbc2ac399f977ac113d90d509c4023c345ce75e77184a3727150a6969e0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805068, "uuid": "f75e2232-a006-4329-b23e-d5c790fb2805", "comment": "Malware payload (AsyncRAT)", "value": "4cecc8dc06c90915b68ae376e53e9092cdc2316b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805068, "uuid": "afa90657-a087-41ab-9661-fa2d29926fec", "comment": "Malware payload (AsyncRAT)", "value": "327e71351b6a6ffd790fe3f675ae1af5a2184945ffe35d0932484f6959b1529d05c397e0bba2f7d96f309c9188a56bc0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805068, "uuid": "5fbb8605-ba2c-47c1-a37b-a067fca753f8", "value": "B0132B1030430272C758273609FB0E1AAB73B3C2C9A18B1FEEB76B45DA6A3B55D5C65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805068, "uuid": "403a3ad1-5413-488e-844b-4abe3e0b6045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805068, "uuid": "8dc474f3-e747-4e0e-88a6-c182ebe3c0fb", "value": "768:AUTVAfGUeB+zHsNMdq9zfPQUaeAmNRJLpzh7yi38T61NYciO41ukQZaV2H75sLZm:EeB+zSzgUalyfp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805068, "uuid": "513c5efd-b4d7-463a-b8e6-d2f728c1b4a0", "value": 41736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805068, "uuid": "7f688361-0166-463f-b5e4-e2762acb9ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805068, "uuid": "86546b23-d63f-47f6-aff3-f9b1bba13ae4", "value": "Check_Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b47716-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617775206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775206, "uuid": "3e4c4aa5-bff3-42f1-a2a8-e239694796f9", "comment": "Malware payload (AgentTesla)", "value": "a06c39d7735e3d7cb21fa826d3fe25f1", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775206, "uuid": "fa4cc5ff-f196-441f-9666-4be63736681e", "comment": "Malware payload (AgentTesla)", "value": "edec093ec0a70e58da54a9020c8f55298d3425e4c597fead5c96f94b7dba0a80", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775206, "uuid": "63201074-5b34-4ec8-8815-eb4cf0d2771c", "comment": "Malware payload (AgentTesla)", "value": "d065e7651f096113a5eee314dd310d004de320e3", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775206, "uuid": "7aa928a0-3810-46c7-8cb4-5e8a421ee84e", "comment": "Malware payload (AgentTesla)", "value": "ef58ad62bfbe4f15934cc5c253d54ae44fec3402790b5915b54549d285a0faa14d0e4f204c7dea5ab527380a7d06e3d4", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775206, "uuid": "a9ce2d86-d217-444b-9646-500bf7e68c69", "value": "B8B4233B6995384995903157EA4530CC2C9ABE01C3D2E91E3336F85BC35BDEE2AED81D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775206, "uuid": "d011b31e-9cde-4433-b772-40d5fed4494e", "value": "12288:QQjg2kCrMILtbnsFlVzddm1+ngNIyIt4EIuMl/:9jvkCrMILiFlBr4dw4EI1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775206, "uuid": "cce70741-c7eb-40e3-bf99-f9771b274327", "value": 498469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775206, "uuid": "1f022ab3-7d86-456d-a90c-47c507f39f4a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775206, "uuid": "d76b685a-47dd-4e3c-ab11-7b67dfd87345", "value": "QUOTATION JANUARY_ALFA-NISTRU_20210129-20293083020234.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe74df9-9790-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617793217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793217, "uuid": "0ccec2f0-4757-41a9-bee6-228589fb6d68", "comment": "Malware payload (NanoCore)", "value": "67b96dc502b0c7a496092d7e6d1da6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793217, "uuid": "1b5fa53f-ae04-4f0b-baf7-3c035b9933bc", "comment": "Malware payload (NanoCore)", "value": "ef5cb0bfe2d23b7a13b685f43dc9a100dac402023e11dce7991173bde63b298e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793217, "uuid": "4925acc7-2b70-4b3f-9489-639eb7b4a13e", "comment": "Malware payload (NanoCore)", "value": "a7c79eeaaafb23e8e40457cd5d44c61148cd1f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617793217, "uuid": "f5aa44be-6d0b-43e6-8a94-7da210378e69", "comment": "Malware payload (NanoCore)", "value": "063c26a3c249a5a009a22a051ea74e7f7c4d07aad2f4f5c82c943c2b0c9dbe76b75ff9c3f68e1490478f5c7a912f6321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793217, "uuid": "75ea8e67-747f-44a9-8930-c713f81df443", "value": "1943A8D88AFE9475C6BDD2FBA0903644B7DE27401B05B5CBC60F8039EEC2999C09DD96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793217, "uuid": "143a2c04-61a0-4637-808d-cf9ed3aa270e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793217, "uuid": "3ced09d0-a1f9-4899-9905-2ca3bcff1aee", "value": "768:b/LA9K0Ubu5O9ooy+bwEbcpo31EKGSBAmoSOh:bzIKS5uAmoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617793217, "uuid": "72968df2-2bf6-47a3-aa99-2f7a0a6d0068", "value": 55488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617793217, "uuid": "3479c15c-620c-4ad0-95be-896104acfd93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617793217, "uuid": "9d0062d8-d8b3-41b1-beba-2f331ac636cd", "value": "RFQ #46200058149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464f4db5-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617775108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775108, "uuid": "b96f1f1b-de84-4df4-bdd8-4ef627c736de", "comment": "Malware payload (Formbook)", "value": "4b574317d2fbf7d16237345157f16dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775108, "uuid": "a6d946ab-5565-4f3b-ab58-22af2e8254d7", "comment": "Malware payload (Formbook)", "value": "efa63822d503d39c7cf4ed12eea7c23780a146214aafcf5b74a18b859c5ab5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775108, "uuid": "81ab3c95-8da4-4407-b16a-be04c69938d4", "comment": "Malware payload (Formbook)", "value": "50278e6770d2609691d718806d63aad7612a497d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775108, "uuid": "3b06332e-7296-4a09-a06e-d4c2019c0ddb", "comment": "Malware payload (Formbook)", "value": "7f0e836799b3372ad0a639027fa8de74fbe3179fe1f9f39f76d9c0bfcb8e7282625b760115b9973ee3a8fdd153eb7a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "THA", "colour": "#1F75A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775108, "uuid": "05d18456-7cf1-44ec-9fab-409f6d6661b6", "value": "A425BE2A23501B93F13D6735D1682E1443F0687EB262D7CCBD9CB69FA9A1BC29533217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775108, "uuid": "777d81a8-ae6b-4e49-ac14-7e7990c729c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775108, "uuid": "757fb04c-12d7-481a-84ce-802f59d24ea0", "value": "24576:tPbmeODnChLoxKgnIxjQxns5QVvHPad1:QecnwoUQBns58vHid1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775108, "uuid": "dfc074a6-1022-4231-b068-4f273088e7a0", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775108, "uuid": "be999fe9-a1b3-4acc-8d53-74ca1d088363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775108, "uuid": "7f80c5d5-a9fe-4737-a5e1-5f9b9b24066c", "value": "\u0e23\u0e32\u0e22\u0e25\u0e30\u0e40\u0e2d\u0e35\u0e22\u0e14\u0e1a\u0e31\u0e15\u0e23\u0e40\u0e04\u0e23\u0e14\u0e34\u0e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29b5212-975f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617772364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772364, "uuid": "f15ba734-e447-414e-956e-45bda0c92584", "comment": "Malware payload (AgentTesla)", "value": "d3d868ecd75585fbb01288fe563808d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772364, "uuid": "d8c95f69-314b-49a3-a64b-fa410804e726", "comment": "Malware payload (AgentTesla)", "value": "efcf88a9730a11c5f1c8edafa5aaf350c5f455f7aafe5d11142f43684d81df4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772364, "uuid": "96cd59f6-72be-471b-85a8-4185896eacdd", "comment": "Malware payload (AgentTesla)", "value": "105776bfad326c526c93b169a67c522706648137", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772364, "uuid": "1cef556d-a82b-4b58-9cf5-4cc0de859576", "comment": "Malware payload (AgentTesla)", "value": "40bd984f07915fa104025c6c0fde543fa6d9065671658c9636e926f91e94bcd9d0710af0f53ba275de460550079ef3ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772364, "uuid": "81078093-d9f5-4a12-8b62-3f36e76b948b", "value": "FD05DF641E4089D6C7E836F44852D6640ABD5EA2BFC5B70ED7B431E8AA3673BCC1211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772364, "uuid": "d11ef74c-0a74-4350-94a2-6a133783cf2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772364, "uuid": "bca0cc9b-f965-4c9c-8b01-d879e85fdbd2", "value": "12288:y2D6ziKeAL+4l6ES2zsGt2Bfu1QrmyvdItqnaGK9MjvLeI:xVAL+4l6hAJ2YvxsvLeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772364, "uuid": "60d155c8-3a49-4fab-9c88-03232bc43f7b", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772364, "uuid": "6962eff3-6681-4c32-b709-aada289cb962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772364, "uuid": "64063324-8182-4a35-b125-88e56084fc51", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077300b4-97b9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617810651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810651, "uuid": "888cb578-b1ab-4966-82c6-a876389a06d8", "comment": "Malware payload", "value": "105dcee7b8a2d60bc861f084213645f0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810651, "uuid": "15ffb999-cb68-4431-ac26-1cdf2104dae0", "comment": "Malware payload", "value": "eff9b98d2c1db45cbba6e3205094ab2d1873c0b5516dc3df3535d7b2d80fd5c2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810651, "uuid": "93425508-3313-483f-be21-a388173c327e", "comment": "Malware payload", "value": "d7bedaffef7668a375b6df082122f8fe6c209841", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617810651, "uuid": "b8431ae5-8b03-4427-9927-84181ec276cf", "comment": "Malware payload", "value": "df7ed650ae9e4030797f187d3b5c1cb046c44926ddaad413979c9d332eca8e5653876a09996288000bc2ddafac2430e0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810651, "uuid": "9bd68c64-3708-45f6-9cac-4177261daef7", "value": "3AB3CE29E1B02E00EEE5AD77039355916AB447FFD0436C2ED4E66D112DB733A42CA29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810651, "uuid": "03e3a685-c6eb-463f-967f-2a9c43500fcc", "value": "3072:jIDARLkFrE3f30Ytdu3IEhnPk+UO4gq17TRo0n:j1RYNCWIanxUhgqpRoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617810651, "uuid": "53180304-b3db-44af-b7aa-f22700f04a87", "value": 108150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617810651, "uuid": "61397116-c3b6-4c23-88c0-7d08171c1100", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617810651, "uuid": "3c480424-73ec-42cd-9924-ff4ffe10c42b", "value": "8e29685862fc0d569411c311852d3bb2da2eedb25fc9085a95020b17ddc073a9.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7662d154-9798-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617796664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796664, "uuid": "832acb61-d7db-4691-a377-f294d175ddfd", "comment": "Malware payload (Formbook)", "value": "b2b0b407b5bc73c36fa750051f2768be", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796664, "uuid": "055876b6-1630-4e44-ab1d-114e40494ca7", "comment": "Malware payload (Formbook)", "value": "f1032fdbd91c560c1d13bddef576404c361c2dbfb6c0381b1476f66e701096b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796664, "uuid": "d2e03ea8-e7af-4d8e-a7b9-d8162a766254", "comment": "Malware payload (Formbook)", "value": "f693d3327c7a1d221bede5cf81caf0c30886dd35", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617796664, "uuid": "bf8d1299-0d22-4823-bd2b-289a5116f85f", "comment": "Malware payload (Formbook)", "value": "1e58631071ddddb14465d1b6e3a42e7aab47776faa859749529e59f96e2eecb54b9a2a348f8b2aef815e72f0c3df4539", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796664, "uuid": "82e25bba-9c93-4e5e-846e-392e4c5dfe7d", "value": "C315F0202A988F55E43E6336053654A047F2BDAED336DB1E7DDCB1DA2B33A145237B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796664, "uuid": "1ad769e0-24ca-4764-b73f-1ef489ad2e3b", "value": "24576:3ehAesJPxtoGyiI7bMQVtbl1wm9YL44Mwv5N:3ehAe0toGqbMQVtbl1wmuc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617796664, "uuid": "b9348720-b558-4bf5-b92d-94d9db5d15aa", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617796664, "uuid": "53a6f4d4-aafb-468d-97fa-3a6445a2482a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617796664, "uuid": "b272809e-e0a5-409b-a746-d53cc5176972", "value": "RFQ_AP65425652_032421 urgentes,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862d8f9e-97a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617800556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800556, "uuid": "d4450437-83c6-47a5-b4e9-8fe33aaff113", "comment": "Malware payload", "value": "32e10425ede3e71b8b9953f2e8e59c0d", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800556, "uuid": "2c3deba3-3470-4f26-9312-e3edbbb0d12e", "comment": "Malware payload", "value": "f221e5419634206f43b7fa4223e09cd39e081efb942a89ab92c29b7fcb94fd38", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800556, "uuid": "9568678d-f182-4e7f-acd7-f296b05a6355", "comment": "Malware payload", "value": "e7b0ea79afddb8e29328de85a6765cb120be0325", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617800556, "uuid": "833c85db-cf85-49c8-b8ad-1a8ce3d86a93", "comment": "Malware payload", "value": "afdc0d8e07213f0d65db27dd72ef87b2bc253918faecaa74bb2ee80db866fcaca354d9b046010cafb33073a1b95a6020", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800556, "uuid": "e79d6c0b-10fe-496c-a68a-f627148072a5", "value": "D6F4334148CBEA7595493485D34BFC14EA8A3D9CBC346A76ACE0277FE80B50DCC49BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800556, "uuid": "4e43758a-fef1-4d4c-bc4f-0f5668aa9eda", "value": "12288:cKriJzhG4j11YMD5VJzn16e6rryFIBpXDm525OLj70SwbUFWo3BnQOyGgkVUkzZW:XkzhG4lD5rTwDra528j0SUUFW4Q/Gf3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617800556, "uuid": "b692e240-d1ad-40fb-b2b3-8dc3633ee257", "value": 782278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617800556, "uuid": "e3086333-956e-4a41-99ab-2e6e1c3709c7", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617800556, "uuid": "d4e2aefc-652e-4db7-a56c-fc66613ccab1", "value": "Request for quotation_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a20edb-97c8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617817493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617817493, "uuid": "5e44d8ec-1c84-4af6-95c8-34c401527ca2", "comment": "Malware payload", "value": "aef6919de68136f45346f2f24d734936", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617817493, "uuid": "44050ffa-bc10-45ce-8aa8-65787bb15c24", "comment": "Malware payload", "value": "f3109ce6288065dd994041e1b6d350e67f0ac913ee6607592315715f2188b6b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617817493, "uuid": "991862c0-5e83-44e9-9574-7422b882bae3", "comment": "Malware payload", "value": "bec42be284e00232e6263c71fdf1e205a001f91d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617817493, "uuid": "eb981a02-81bf-4014-99e7-22fc5c48962a", "comment": "Malware payload", "value": "7ae7fa5837fe36a574f3914030a2e0825589145bc446465801d0f353318a802febdede7aef4bef1d05136c738a675fb6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617817493, "uuid": "ef3a0f20-2521-49d6-a5c0-ceede23b7743", "value": "72F53324490B9577DAC222F73BA52428600979B4B42DE4E76FFF49C9BBF02C741CB509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617817493, "uuid": "bc006c35-91f4-4e51-b639-6804429464f5", "value": "98304:PkdjXT4Ntyec6ZvOLY3vU+BITKbOhkg3Sb4lYwhE:gbEsKhvZUKAkVbkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617817493, "uuid": "a3718c99-8c5b-4517-adb7-29e83b22c08a", "value": 3609237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617817493, "uuid": "feb49565-3b83-433c-8a42-6b3f3a653809", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617817493, "uuid": "d90cd0e9-9e6e-4448-983c-dcd797fdbc5b", "value": "private.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6b162c-9756-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617768246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768246, "uuid": "5147fd75-620b-4082-b5cc-f207bbe666b6", "comment": "Malware payload (AveMariaRAT)", "value": "1f87348ab64e5b7c5d7c7a010251904d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768246, "uuid": "0943b95d-c232-4398-bf78-3d9988808c2c", "comment": "Malware payload (AveMariaRAT)", "value": "f39db650747130dd3ae0e3a1b1912ef321a70bce4dbc07ddf7cbe28c4273dbba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768246, "uuid": "981bfd89-815f-4e85-ac27-e4b7d006c921", "comment": "Malware payload (AveMariaRAT)", "value": "624ed4ab4eacfb63176b60dc4865b77f2b932ae4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617768246, "uuid": "31f20bff-147f-4487-ada9-6872c6797603", "comment": "Malware payload (AveMariaRAT)", "value": "e8608345b095558b93011efc11679abf47061490fcb0e418e1a3159f99f463190ba5c923c6444eb02193b3ab00fc884d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768246, "uuid": "b9a5dd03-f507-424c-b246-36937d45f40b", "value": "F8F4F160B35ADB81E42A27F24976810243BAFDDC2853DB1E19997AD7327270D1CD1EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768246, "uuid": "2070e711-2d85-4fce-a21c-c309db27d468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768246, "uuid": "4eafa176-303b-4b68-ab40-d3b29969d2a5", "value": "12288:AggZAUukJN8YvpwcBCBwlDRskhBBjs4use8uiPpQZeva+eEAmD:AggSUukgmCcBCcDagBBjs43jFaZT+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617768246, "uuid": "fc911d9c-3ccd-41de-aa0b-f67667c55ca1", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617768246, "uuid": "546f9fb3-02b0-45e1-b0a8-18e108513d06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617768246, "uuid": "c8e0c4fd-e8ee-43ed-86eb-98f6e009ac91", "value": "Fast color scan to a PDFfile_1_20210331084231346.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3bfa40-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794469, "uuid": "a2c5ea75-efb0-490b-bd31-c31dabed858a", "comment": "Malware payload (AgentTesla)", "value": "a6df05ec231e70e4aa44b0aaf2711d1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794469, "uuid": "d63da582-b85e-4474-9110-c57dc61a575d", "comment": "Malware payload (AgentTesla)", "value": "f7053c41cb71ba12cdb429c7e47b5a5f57bd9ead0fceb219166c03c4518e0537", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794469, "uuid": "8342a7bb-6f04-4a72-9a8f-3f7b4690b68c", "comment": "Malware payload (AgentTesla)", "value": "40af49095410cbfb69def851a1f7dd1c86400ece", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794469, "uuid": "ff86dc54-270d-4832-bdf0-ab98ac588f62", "comment": "Malware payload (AgentTesla)", "value": "c52655c58bfc4173395475a68010b05a565222b3ce59b24a7d4a56d59aa712ff2d95b68bd0958d5f33c9696a541e08f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794469, "uuid": "cb4b0153-9e1d-4db7-835f-f61a58bf4ff5", "value": "1F05F1216BD89F51E03E53361126606103F1BE7AC73BE66D7DD872CE2A72B444A73B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794469, "uuid": "a456c325-b7fd-4121-bfc8-7828cf873370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794469, "uuid": "ead193f6-a0d0-496a-a8af-c30f15a472de", "value": "24576:OWN6ktOIFlOII13u2Are/x0hEPKCj5g5+C:OWN6ksGlOIOe2AK1jG5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794469, "uuid": "64eb7df3-2197-419e-abb9-0b6dcfc8c5a9", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794469, "uuid": "abf79a81-015a-40a6-b962-40db0deb7fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794469, "uuid": "b7f2a013-0d76-4e17-bf77-747aa36b06f8", "value": "Invitation for Tender RFQCSDOK202140890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da35ae7-9762-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617773376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773376, "uuid": "917e6e16-3c98-4053-8b3a-b3e731a7d94d", "comment": "Malware payload (AgentTesla)", "value": "deb848ae83aa7466e417456eec6d6c47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773376, "uuid": "ad1cf30c-dd43-48bd-84d3-77a3240af132", "comment": "Malware payload (AgentTesla)", "value": "f71e2502fed0fa64fd2bc7923c2135dca427d8c3f33b3da764562a6302657b8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773376, "uuid": "db8c6d38-3109-4800-b68c-664c1f12bd19", "comment": "Malware payload (AgentTesla)", "value": "1cbf92ceced925c8925c54276f47d08b12b0374d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617773376, "uuid": "0f0b55c4-1dfd-4bd3-830c-1e216b7ca92f", "comment": "Malware payload (AgentTesla)", "value": "d2fe2ee473dc51458f1dba6b19dd5645c6605a6edd41c90659baf88644245bbff1dedaf03f374e6ca0451c1b492110ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773376, "uuid": "246d89f4-52a0-4465-9c2b-a0ef939bf7df", "value": "070501247399CA81C86803B2C5A388435771FDD8AC13EF664698B2D53832B4C8DDEDE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773376, "uuid": "2b334a68-8a27-439b-af01-658e1cd54bbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773376, "uuid": "97e4dcd4-f06b-44b5-a48f-7a2d412c4b54", "value": "12288:2gIlg+yzskuFhCGn0xwgDHqWfoyqO/G12vfafmXNG3lvHJzuLY3wQZt:9IlJhvF+xwgDHngyfPxQ3lRzuLowQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617773376, "uuid": "aa3000ba-a3ca-41a6-98d7-800b5098864f", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617773376, "uuid": "3eb84976-4638-4d93-a3f5-dd68835fc103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617773376, "uuid": "4d490f34-f6e7-418b-b630-523b57ad82a4", "value": "mv Sider Capri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c65e96-9765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617774913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774913, "uuid": "49e668d5-7c05-4391-8b04-e92388e10c9a", "comment": "Malware payload (Formbook)", "value": "62f2e02a7444736af7d43a473f41614d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774913, "uuid": "dac3a0d2-4de1-4471-8b1e-a7ea3f86699b", "comment": "Malware payload (Formbook)", "value": "f73bd79fa45052bdee47d286e58107be584dd64d6cafb38362d494d9b388356f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774913, "uuid": "eed5285b-54e0-4c5b-8d8d-25f86e32768a", "comment": "Malware payload (Formbook)", "value": "362689cdf7e3152161fca7c5b3999887c664984f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617774913, "uuid": "7f39f97d-5284-4e4b-ad19-35119ce03244", "comment": "Malware payload (Formbook)", "value": "d06b2c1867a1c9783dfa01589cb9a6ed0233bbfd94d7cdc061db6a927d817dcfe5dfb6922dfecdb9efa150f95aa938ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774913, "uuid": "8c5c48d8-a931-4638-bfdd-c7efc8da2b56", "value": "C84501246E9916C4D9FE36F4186280500BBDAE127BD2F718EBF474695E32933CE1061F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774913, "uuid": "ca94b1d4-6f15-4ebd-b1c9-776c45863d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774913, "uuid": "7679d27d-f610-4462-a007-ab827cd40587", "value": "24576:/FLHeRHu4NWikhWCRy65WvSrMjuQKGpJHOZ/69NR4/z:/FLHeRHu4NIhWCRzQjlJCCrR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617774913, "uuid": "c34940a9-d23e-4b2e-b48b-49e5f88c444c", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617774913, "uuid": "c1fee090-8ce7-4150-ab89-528afdc2f931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617774913, "uuid": "b58e8b53-52fd-41c8-b544-8e522e770d0e", "value": "taiwan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a2eebb-9793-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617794441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794441, "uuid": "d7379409-a63e-437e-ac32-95621d405003", "comment": "Malware payload (AgentTesla)", "value": "ac2edc59321e246a08e05437b0aa1934", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794441, "uuid": "f531e088-2b56-464a-a56e-4097e4b104cc", "comment": "Malware payload (AgentTesla)", "value": "f90867ae287398ce9cde1d08f2223f188483bb5ef0ace82b071964b64270f5ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794441, "uuid": "24a60a8b-abfd-4d1e-aa3f-bb1090025699", "comment": "Malware payload (AgentTesla)", "value": "794a9830f144394c0cee519c89d6e339026f7705", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617794441, "uuid": "7e35f7b8-6c5e-4ad9-a7fa-40f8f6c6bc9d", "comment": "Malware payload (AgentTesla)", "value": "8b13c5f8168cbbd5aa21b22a293653087896d3afe3064cd3d2090e5e21fa9596b00b37d458eac9351c8f5fa0e1a9f304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794441, "uuid": "e2cfa1da-f65c-4cbc-8517-f84db139a1af", "value": "E185ADD1EE86EB54D17953F4D05C811883F1EE4AA321DE493D8CB38C5671A8ECAE52F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794441, "uuid": "c7e49f25-27b8-4574-b091-44300702761c", "value": "24576:d0bcVeMHDnrJP36dGApYa7E3l2rJky4MuWzxQiKUT:TtjnMd1pBE4rJn4MTFQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617794441, "uuid": "50109c8b-aac4-4e9f-ad13-434e5db4d84d", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617794441, "uuid": "53e77f9f-3a32-4e72-a995-0723a8e2fd0a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617794441, "uuid": "719f8c5c-85f4-4444-ba0b-1d0dbe66e1e6", "value": "LoganProj-PO46523_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe7fd5b-97d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617822476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822476, "uuid": "6aa78f4a-3f56-4710-8a94-29c13a34c384", "comment": "Malware payload (Dridex)", "value": "3def7bbf7302fb3320fd9c00ab8cc89f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822476, "uuid": "0002cdd7-6687-4879-b7b8-b8f87969ca3e", "comment": "Malware payload (Dridex)", "value": "f91f392acb4e907b5c3fa94df6e48eb2416fc1f04fdc0cbb7dfdad5de8c8b0f6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822476, "uuid": "8cd17a57-fa25-4c4c-b2b4-7cf45a5f1389", "comment": "Malware payload (Dridex)", "value": "8f6918ae934865b61869302497967b6a5110217f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617822476, "uuid": "687be3f5-4330-4776-908f-053321438be0", "comment": "Malware payload (Dridex)", "value": "5f915b834d019e4b9037becb93e9246ca016f9390c2d56d8e12d3238996ef134f724569916cc00e2015504d05928f86a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822476, "uuid": "a08eee59-b15d-45ea-bb3e-6b3b912d9538", "value": "B014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822476, "uuid": "361901e2-3e9a-4635-81db-51b546dbc779", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822476, "uuid": "34004c0d-c4f9-40f8-a426-546ffae45123", "value": "3072:8BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:8BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617822476, "uuid": "f279efd3-a8e9-45ff-b204-781899af2a37", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617822476, "uuid": "d7aca97c-0e23-40de-a710-63c7db27e861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617822476, "uuid": "49f31d1a-9036-4c95-85d9-0938c05a92ca", "value": "f91f392acb4e907b5c3fa94df6e48eb2416fc1f04fdc0cbb7dfdad5de8c8b0f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb3a5ca-975f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617772356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772356, "uuid": "f4159d1a-1281-4fd1-be65-04a47c2c2497", "comment": "Malware payload (AgentTesla)", "value": "806cef4d78142506b6ed99c35b2b5e66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772356, "uuid": "b8f01239-50d4-41cc-9975-08b358c508d0", "comment": "Malware payload (AgentTesla)", "value": "fb2341aeaa8ee9f0411a9d587369ab5227ab97db5b6dc44ace8cbbe565cdf3d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772356, "uuid": "5672334a-e031-4698-83fb-112bd83ac304", "comment": "Malware payload (AgentTesla)", "value": "b11a318665dd4a3a5e29600edcd33c458d5dc94a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617772356, "uuid": "50386e41-4b23-494e-89f4-535bbc5e6bf3", "comment": "Malware payload (AgentTesla)", "value": "8c2b1a5f8594f5c73050c4eddeabd4fb2e709fdb86de3834f8f0c8cd41460a080361763d53121d0eba41443a71c6a493", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772356, "uuid": "c6d76dde-6e55-48bd-b1b3-cb7bcb0a4f98", "value": "93D4232D14C7404C296578FC48C8C3D76B0DC9A59CEE6277AA8764E063CF2269CD6FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772356, "uuid": "fb29d60d-012a-4454-af3a-d0de4f78758f", "value": "12288:gFdHE22I40fXwJ2NLpBgAaj65pseDQCmiRy2fLr+kMgLGvN9Dbr:gFJEcRfXwJ2Nb0uqPjic2fLKVgLGvN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617772356, "uuid": "f3ba4f07-531b-4eae-a2a0-85b78bf86d20", "value": 617384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617772356, "uuid": "c55b1958-52ca-4093-878f-77bb4e7e4de7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617772356, "uuid": "236ee056-9085-4de0-86b9-24bdae4c0280", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0deb3ff-97da-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617825189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825189, "uuid": "edaa4306-586e-4d06-bfbf-11cc77b0643f", "comment": "Malware payload (AgentTesla)", "value": "c74c39fb99c0a0d7d85fd45c49c1da07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825189, "uuid": "54581f47-bae2-4b14-8cb5-5f992973fae2", "comment": "Malware payload (AgentTesla)", "value": "fca0e8af9a91e1c055259e1546bd1e164602ffc6973cc3ae877a1a29045561ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825189, "uuid": "7f60d2f5-e266-4a57-8244-0cf7dff513a7", "comment": "Malware payload (AgentTesla)", "value": "3d9c6b085f89af950c83c9e92720bc27d3cf7a97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617825189, "uuid": "45dff64c-be73-4a38-bdf3-0dfca1860964", "comment": "Malware payload (AgentTesla)", "value": "f8b22c97b10e70ab91eddf5ab7c59efae62a2881f1ca5c740ca70c1ae34ad41d5cec8972273ce08360266b63a667f33a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825189, "uuid": "4ece0ff7-9e17-440f-93f4-9c3e0f4175b6", "value": "3D05238EC278733D494F4AA8741B486EAA334801D99AE7DC157953E55FE9FADE013CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825189, "uuid": "4249f002-7fc7-4d6c-808b-d3036647ca2d", "value": "24576:eb4Fyz3v6X0btc+1FlAYpG2VB7E5PMml+fM:e9LrBFle2VB7Emm8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617825189, "uuid": "90858503-5462-4158-8236-040f6e837dc0", "value": 811304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617825189, "uuid": "8a01315f-a2a3-438c-b635-9267cede3d63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617825189, "uuid": "6709029a-f999-48a8-8fc2-1f23161cedf7", "value": "PU Request Form Hardware.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7142f9c4-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617775180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775180, "uuid": "25c62dfb-c19c-4742-9dd4-9de2de5fe77e", "comment": "Malware payload", "value": "910151a47fe6eef89e540f1de3963c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775180, "uuid": "abe3e19a-e98b-492a-89ed-9f02e700f765", "comment": "Malware payload", "value": "fce02379a51022b07ef8b83985266c08fddc142f9edde3d74b74713068682984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775180, "uuid": "14450d63-4a04-448a-b346-561916401af4", "comment": "Malware payload", "value": "0bbe14a3eeb17f8b40aa655a24b9a5b877a88220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775180, "uuid": "491f8548-c0e2-4e5f-9d25-7dc9e69a6783", "comment": "Malware payload", "value": "76404dfaa19f6dbccbdab30ba3fc2d080aa582fc9740a5a1693f84858374f3a62298c21743281c93a7d00366f4aade59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775180, "uuid": "2bd4d734-dafa-416f-bfb3-04131255a793", "value": "1B4487242254AF36D56DB3BE1064941713F8B16EE392F638BECE64F33557F65A280C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775180, "uuid": "d42bd23b-d919-4b7a-8d79-788df8422a6d", "value": "1536:ZZf6VWW+9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzx9tzt:L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775180, "uuid": "c18c9c9f-587d-40f2-be8d-e199fa50f3a8", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775180, "uuid": "5028e75e-ef25-4dd4-af4e-e7833dad135c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775180, "uuid": "9a2faacf-fcd5-4f2b-9fa1-dadf1b73be92", "value": "Overdue Payment_USD.106,375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd49934-97ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617805129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805129, "uuid": "f5082d64-7dce-4540-b94c-c147604f4257", "comment": "Malware payload (Formbook)", "value": "b266d26c70a2c1fbb9461e51ca827261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805129, "uuid": "b082c115-fe3c-4517-b677-7a09e7819c38", "comment": "Malware payload (Formbook)", "value": "fd0cf58b93453778c312805f74673284da2548389ee866c37cc91431f0ba9cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805129, "uuid": "6bac8ac0-07a9-4d13-8be7-4cc91c354347", "comment": "Malware payload (Formbook)", "value": "b9d82bf52eb9efcf2efa211fb20053838c412d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805129, "uuid": "979f164c-3482-4461-a3ff-7c27c31b4920", "comment": "Malware payload (Formbook)", "value": "f32c285557d7a53c675278ca1bbc24bc147ba4e8a458e81ff8a463ca174cdcda7fbdd35225f4daddfd33f7f30deee780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805129, "uuid": "31f234fd-791c-44db-853e-73f84b82b3ec", "value": "4734E163A1F0E6B7D84208B30012B3F25FF650D1D301399777876DAF495BA299F1EA4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805129, "uuid": "daed014d-2179-442b-bcb2-33aec219cca4", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805129, "uuid": "f5167991-d1ee-498b-8b1d-96220f287c3b", "value": "6144:DDIBfAazuqWz8rk9OJjoM8rCQ1FVCC2izEncSOX:GmfQQa/82Q1Fj9EHOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805129, "uuid": "526bc8a5-01f7-4f7e-851e-027167e11651", "value": 240872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805129, "uuid": "95f37e21-0d6d-444b-be2c-2e5f82f162d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805129, "uuid": "453d7c0c-90a6-4121-b202-1860d5774e96", "value": "TACA20210407.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc2d9a3-97ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617805318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805318, "uuid": "70873aac-c545-4b13-9b3b-921e1c2e7933", "comment": "Malware payload (TrickBot)", "value": "6c27902679913bb13e0732735ea73ddb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805318, "uuid": "ec5f3888-0e90-42e3-8b89-1dea24209988", "comment": "Malware payload (TrickBot)", "value": "fd3af0e7890546cc6e6ee828df5a31a4c88c587f968b0298a672b703bf71b7e4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805318, "uuid": "f7a7d11e-1dae-4a58-a143-efaac008ab57", "comment": "Malware payload (TrickBot)", "value": "b1674649dee5ebb75f8e6c4cd8e165714ea4d444", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617805318, "uuid": "4a9b6050-1b63-40ef-aa0b-beab13b395f9", "comment": "Malware payload (TrickBot)", "value": "75abd9d51c8bb3b633fa03677c127be6d61829d9bff72a3cf62703a422897d2b3fa37cef1d9432b9ca904177cabad5d9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "rob45", "colour": "#A561E7", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805318, "uuid": "0a14b563-5478-4383-b196-8df84882a30d", "value": "AFE3AD03B688DF22E12952FA0E87CEF8365A7F459E01C2A731983B5F7E745600986B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805318, "uuid": "a295b78e-0714-4d05-8c39-06709167d61a", "value": "3072:sBFS6igp+dDroFMky3zbcNXg+UiGMr0KKq+:sBY6igpCiUzbctGVMoKKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617805318, "uuid": "36eb14d5-f131-4015-ae17-f3364884022d", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617805318, "uuid": "69332ae6-d798-4305-9693-d0aaaaa72f45", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617805318, "uuid": "2b55fcb5-9ea8-4559-bf99-5998acc9bbfa", "value": "reorder_6041.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b8b8f5-977a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617783907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783907, "uuid": "6375c7d6-41a9-41a8-b2ec-1a0518fe8970", "comment": "Malware payload (AZORult)", "value": "79c88f12c48f8307763bcba87f443337", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783907, "uuid": "bd036fb2-997e-48d4-911b-000eafdb6be1", "comment": "Malware payload (AZORult)", "value": "fe4e3fc81c2e5028cde6ef0a91ac901fa6b5e0e5e2cd6d68070a9f45cc3a4b69", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783907, "uuid": "f852ec6d-a771-43e7-a6fb-bd425083efd2", "comment": "Malware payload (AZORult)", "value": "af17a6229b33656e042160cbbd335e1479e29acf", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617783907, "uuid": "f1e5c8ae-352e-426b-b07a-51566a5677a9", "comment": "Malware payload (AZORult)", "value": "2d254a1723d42598742bdc2192a2fe848c83d115df9554848bb7dc089b0e7e5c386afad6a267f2e7db7ff8cabfb08b7c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783907, "uuid": "12327ad0-2383-4e43-af03-45d1a2d81b4d", "value": "55F402507741CB41C86A47B2D56288034335FDC87C13DFAA4A98B2D63872B8D9DEADDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783907, "uuid": "c6b17286-76f4-4a1d-87e7-3ce1cebd95bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783907, "uuid": "dfefbeb3-13fb-4b2a-b033-9d24d30c58b2", "value": "12288:SjMlx+yzspcRxZo9M+cW1m25B9TFhy3dIRE4F33IiiOkB:aMlwhiRxZArcW1TrThy36+4F3COkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617783907, "uuid": "598dafc8-6d5a-4160-b334-e654bb167243", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617783907, "uuid": "fafc60b0-7da7-4ea2-846b-00c69a73918c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617783907, "uuid": "2d301532-aae7-41a5-837c-5de7ee985dd7", "value": "e-dekont.html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1380510-9777-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617782589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782589, "uuid": "5a4645fd-cdfe-412e-b787-7ad94a745db5", "comment": "Malware payload (AgentTesla)", "value": "96b5b7152b1bf3ecc7425d15d41e7152", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782589, "uuid": "588aff6b-779a-4eea-a732-bb96e7eea4f6", "comment": "Malware payload (AgentTesla)", "value": "ff7cfa32cedd5fa246f999297b1330baaf922d5cd878883438a7e5e65d054362", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782589, "uuid": "125edcd9-e2f5-4c8f-8864-4d4bd370880e", "comment": "Malware payload (AgentTesla)", "value": "7bce020f5a3a1f907daf0ba4d57e3f563c3374e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617782589, "uuid": "b6ba73b4-59a5-49c8-8c01-234a8bd3694e", "comment": "Malware payload (AgentTesla)", "value": "74b86f50439751df7d7c6c02040884efdb4e11c54963087a47a92690c9e75a5cb87701a2a08261ef1d88835f3d85fe28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782589, "uuid": "f25d95c2-24f9-4be3-8239-1616b147a8d0", "value": "D135F0323254AF92E37D97308461927407F1BE57EB21D74E3CAC71DC6A32BC68A62752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782589, "uuid": "65bf6ac4-e2eb-4dfe-a285-007a46975ba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782589, "uuid": "6f120e14-b23a-48c2-afc8-f40723bc685a", "value": "24576:PjbiscFDnsvuxlZevtacab98oa5w9JsfmwO5n+7mvLe:CT1n9xlqtacab98eJsLCvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617782589, "uuid": "85cbe36e-1f05-4395-a0bb-69840fa5fc58", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617782589, "uuid": "e4f3a4e7-7cd4-4847-8293-3968f13c3672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617782589, "uuid": "dd741d38-bb0a-4f01-a7dd-c2910ef3fd64", "value": "IMG_00000000001.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f75ec4-9766-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617775212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775212, "uuid": "67c42e84-09bc-4089-ab89-e885dc672b53", "comment": "Malware payload (SnakeKeylogger)", "value": "7a1c5a7b5f77566b36fa05a3425ba423", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775212, "uuid": "9b82cf51-affb-4d21-bbf0-5b7d1bc16485", "comment": "Malware payload (SnakeKeylogger)", "value": "ff92e47986f97be06594eafc7677f4998bee3c35554940afb43957be92427315", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775212, "uuid": "b1f9feba-6a54-4603-9e2e-482c708272b0", "comment": "Malware payload (SnakeKeylogger)", "value": "975096b0eb385974f6210d34b190f6eb8638a625", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617775212, "uuid": "e023cff2-45f6-44a2-a46e-f938670cb9bf", "comment": "Malware payload (SnakeKeylogger)", "value": "4d218839761c33c6ac178a0685166e4651dea8d4c41b3370fa0ca85d54809786661a612a8148a8253ece7e7a906d6ac2", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775212, "uuid": "23eae6e2-cd3c-463e-b7f8-5030b7c623de", "value": "E425E02232956BA5E17E67359030512083F7FD97E332D68E3C9DB19C5B36AC2C262763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775212, "uuid": "8e3dbb01-cb0c-464c-9403-26b51acd8ba9", "value": "24576:2rzb5N3DEp+YDnxGZC+DR/1eG8aqwdJe3zXXkbUqV:29N3DEp+KnA0M1ejGdYb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617775212, "uuid": "0363e2be-7c73-4ab8-a149-6ce10e3519dc", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617775212, "uuid": "b5b65b6a-2b4a-4293-98dd-d824619e4d8b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617775212, "uuid": "48446293-4428-40fd-8e02-f5544230a9ef", "value": "Urgent RFQ_AP65425652_040621,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }