{ "Event": { "published": true, "date": "2021-08-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-10", "timestamp": 1628640182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4a093545-4bec-4068-9ad7-08fc7db5597e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95514785-f9b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586103, "uuid": "8d533fb8-5c2f-4a75-8e68-3bb22d2c56de", "comment": "Malware payload", "value": "f5a72fc362683258f34b50d30726e68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586103, "uuid": "a8565c9e-78aa-4f1e-ae3c-7572f6991b1f", "comment": "Malware payload", "value": "00142e46c997fe7051af5667953908cc876268be30d61cd985f6265514639251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586103, "uuid": "42053f79-339a-4407-ae14-0ce6765977fc", "comment": "Malware payload", "value": "435e3795d934ea8c5c7f4bcfef2beee0e3c76a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586103, "uuid": "6c1206ac-9f8f-4163-a9d1-7930e9c5d6c0", "comment": "Malware payload", "value": "13f60cb30d5cc6c6954fc88f1053f2a3ddeb528de648330795319783c9d09f3a0e6fa53d6ffaec846b8c50b2acc3a3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586103, "uuid": "44a69979-9c3c-4f97-a4ec-0108167c7e7c", "value": "T1FF248C59B2B50CB9EC278139C9534A52E373B8560720D6FF13A0536A9F3F7905A7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586103, "uuid": "b3cbc283-0415-4072-96ce-d5d55247c39b", "value": "5d859b21e47909b5d3ee2ce5970de6a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586103, "uuid": "55b080f1-edb1-4d19-a4a5-d5b76b60d697", "value": "3072:d/mSINYiaA3cWNhcfmVByy3k2eNvN9mNos3Miwk9muPu:d/mAiHZ4mVUyUYOPiwktP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586103, "uuid": "21916576-eb05-45f4-a6eb-43af80a305fb", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586103, "uuid": "e68c42a4-f5ba-43b3-8499-d500febe026d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586103, "uuid": "969ea0ac-5217-4f2c-aeae-4ff66d0c492d", "value": "00142e46c997fe7051af5667953908cc876268be30d61cd985f6265514639251.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b83bd33-f9dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628601495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601495, "uuid": "a8ad71ed-b6c6-4f59-9f54-c6204424bd64", "comment": "Malware payload", "value": "ebb3909fe74535beacb37d53880ce7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601495, "uuid": "b10f4122-705a-4437-bbe5-5a012facceaf", "comment": "Malware payload", "value": "010ae47886c44441e2b89a2b493ba8164e33fdcd97309e00e8b1b54e87cdbd24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601495, "uuid": "e6456cc8-16d5-48e1-8638-022f8368a7ce", "comment": "Malware payload", "value": "57b82444ca934c2817e85fb3f8212eba126983ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601495, "uuid": "ae40494e-c92c-4e0d-8a66-45c18fb57dd1", "comment": "Malware payload", "value": "871a670b1e767063915af43b60e5ee47c3f9510e4f902fe09a772f28499512355c76a3efbe8bcfedaa5362aed5415656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601495, "uuid": "ee22cfdc-cc2e-4198-bcfe-bc82531587b0", "value": "T14FD4234A760DD542C38AC87BE2F7525467F0E6C19AB7C31B309E128C19877CBA7BC54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601495, "uuid": "74d76c99-2873-4a10-9241-539a941587d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601495, "uuid": "cb937f05-0409-4fd7-afbf-69e812b59a44", "value": "12288:mMIoxYRsk0u2aLNoLx6V8WKiyU6J1TsMIizKWD+EDwm1U:KoWRskRTNoLwVQUibzvREr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601495, "uuid": "83725300-2e79-4818-a966-5808d975777b", "value": 647080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601495, "uuid": "2668fc13-9efa-43f5-ad5d-6a770c48da23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601495, "uuid": "0b3f9adf-b073-400e-a0cb-3d834901c011", "value": "Richiesta di nuove quotazioni (August_2021)_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642a44bd-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628608354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608354, "uuid": "d888beb3-be89-479a-bb71-12e50a728e3d", "comment": "Malware payload", "value": "f6ca0052f508770f499eaddb5dfdefa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608354, "uuid": "5a85cd34-11da-4de6-a725-d3750c097dc9", "comment": "Malware payload", "value": "01dccd80e7c6948853bacb394d25995d5886f84c05bfbb506b4c5862d8221901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608354, "uuid": "c187dd73-1843-4473-bbf1-200661efe3c6", "comment": "Malware payload", "value": "83b1cdaa08b1e5c32b5baed55c22608ce9d01944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608354, "uuid": "51a696da-745a-4726-8bab-8253be52d57b", "comment": "Malware payload", "value": "bff4318d569e6d61ec24f5a4dd3d8bf23f0f6f6cc27697eda2a5bec7e52eff5deefe03abc3cf9cf6668948a8807d43e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608354, "uuid": "af54c6a0-df45-41ba-820d-b43700b14ecb", "value": "T1E3F41210BA1BA561D5E80677C2D3AD7C27A0FE13B621D61B10EC7F0936377A6B9D120E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608354, "uuid": "018185e9-71dd-437e-80d1-a8913cc1ddce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608354, "uuid": "20589a88-b30e-44fb-bfcc-44d24253ee66", "value": "12288:8AIfVYIdFMXgcisxVmXldFPaNGhC5VMgSxLH49TWwp8u911p0ziyMtSUPaTfrgKy:2V5zMbiMVAlbPaNG2egFTW+8AsiAUPa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608354, "uuid": "5fc335d9-fbe4-4656-88f7-2f7f80098dca", "value": 732656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608354, "uuid": "c1e594f2-f1a2-47d0-b29a-bf86c727f3aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608354, "uuid": "f64ea486-f99a-4198-b1f0-2e795056635f", "value": "f6ca0052f508770f499eaddb5dfdefa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87c8617-f9ab-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1628580230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580230, "uuid": "6a9b1b99-f46f-4ae4-984a-bd5d0d01d90c", "comment": "Malware payload (Socelars)", "value": "baa553f1e49ce769cdece59801cf1922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580230, "uuid": "acbee607-f29b-435e-a70e-3363aa70f9a2", "comment": "Malware payload (Socelars)", "value": "02a5466eb5df2aef6f904ef7fa8ef36c2b98ace1ae5998cc516ad69884246550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580230, "uuid": "06a1aa06-5e1b-4921-9859-aa07071d1fab", "comment": "Malware payload (Socelars)", "value": "e59fb4277d3d36e140f73fa128b3d1103b375158", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580230, "uuid": "f7891873-aea6-4e1f-99ad-28f2915ce977", "comment": "Malware payload (Socelars)", "value": "eb8f05f5da564e631791ea593ce326c40dbe7d9a8b6c485196a4d5aa1cad1dcf03de7a3caf23dfe29ecc2143e34dc5dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580230, "uuid": "0d3f6e60-dcd7-46c8-b484-5ec7fc983de1", "value": "T1F5659F21F6429036F8E310B286FE477F9D28BA21031494D7E3C41D699E619E27B3B767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580230, "uuid": "e94f7762-36ec-4801-8118-5688b4c55dd5", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580230, "uuid": "de213185-da55-43c2-82fb-05cf6f404cfe", "value": "24576:AIVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQ7Yf/6DP:hFA1pvTMbOwa0TmUyMYEh1oCSPnQ7YXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628580230, "uuid": "ad1d2eff-e376-436f-9c78-c8d312277ab2", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628580230, "uuid": "afd8e37b-6782-4f9d-98c5-827c23f7b791", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580230, "uuid": "fa56a6b3-e53c-4a3b-b927-08f417f13c43", "value": "baa553f1e49ce769cdece59801cf1922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfce001-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1628608344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608344, "uuid": "cb20e66c-1afc-4227-8813-5add30ec3fa1", "comment": "Malware payload (IcedID)", "value": "a9f73033838535c1f9fd9534f94054d5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608344, "uuid": "3c60bd34-8733-41fe-beca-fc32ac420965", "comment": "Malware payload (IcedID)", "value": "02f355e20922fb9f325569f7bb3466587823b799ae4a43bf715ee92864d0bd74", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608344, "uuid": "2b8509dc-f080-4827-bf0f-cdab1fc2b22c", "comment": "Malware payload (IcedID)", "value": "a9d2fa6d4680e36699f7ec7b3bf94cde20a134d2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608344, "uuid": "ba75809d-9af7-4873-8c34-d8c56f05142a", "comment": "Malware payload (IcedID)", "value": "4705b54e571c3e2d0f0567a120c2fc28e88d44105e865933896912dda281425611466c04a31076fa1383970635ed395a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608344, "uuid": "19e5957c-b9cc-4f6c-8936-cfcc85db4143", "value": "T18C03F844B291C617F26156798DD7C7EB3339BC0AAE01832B33947F0EBC796749A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608344, "uuid": "08240c12-c4a4-478a-9bff-c6e95b36b51b", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZkp:GJKCBcEVA8pt/AB6MI2Ur/lVkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608344, "uuid": "f7b9c891-2f6d-4dbb-b894-cba8baf83011", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608344, "uuid": "65c4b631-cab5-45f0-b687-3dd17333fe58", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608344, "uuid": "fbec5a2b-52da-4ffd-b240-c88fc83c6041", "value": "a9f73033838535c1f9fd9534f94054d5.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40620e47-fa26-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628632776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628632776, "uuid": "2f4305d9-5be3-4cea-92a2-c0e0e2598493", "comment": "Malware payload", "value": "603b048d75af2af027badf05ce4fa62b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628632776, "uuid": "0db7b158-5ec8-4e2d-8884-f7ea65af412c", "comment": "Malware payload", "value": "03535f0c9dd34640a80fc2c578a293b34baa183f90e28eb8d2a6f8953e74472a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628632776, "uuid": "d3802e00-3fc7-4d34-b35e-c97ced78ecb8", "comment": "Malware payload", "value": "e66427c4c986484823e75db3cab8f16e3977d10a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628632776, "uuid": "d2b50f77-cad1-41db-bc3c-47799ed942c0", "comment": "Malware payload", "value": "d10b71db12d3629283d597aaf78126c6a296f3ca7820a365fdd00ae3d20db58ff54e97c76b93f04fdd2eb66b7d735fad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628632776, "uuid": "953b4b45-e3cd-4c23-b543-3e3d4f4b536c", "value": "T116D423407BFF27F7AB95AFD81CBB380A74B628A60500F42281BD1D291E617F4D6A5D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628632776, "uuid": "7774cf5c-5380-42be-89ca-dbd163f9edbd", "value": "12288:75GB5HhwZ1799rk8g/v7V3KvGiQsvbqQs7nTpjqSGOuo2aGbKdptKi+lDtO3kk7q:74rh679Dcv7p2GSWjzTTGa2akiTn3Fyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628632776, "uuid": "900c0069-851c-4b29-90c1-997e88d670e5", "value": 651865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628632776, "uuid": "de30f04f-4216-4cbf-900c-be8f69b8e58c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628632776, "uuid": "e1497919-976c-424c-b636-f155332dfe63", "value": "603b048d75af2af027badf05ce4fa62b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7356bc54-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628603655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603655, "uuid": "e14bffe0-735d-4bef-83df-9611cf8a0b68", "comment": "Malware payload (RedLineStealer)", "value": "c98f0728cd52a85325aefae0370b99ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603655, "uuid": "d15265e4-6e10-48ab-bbc5-caf7ba938b1e", "comment": "Malware payload (RedLineStealer)", "value": "03a6ed98578bd9fd4887b208203f0897c4b59a408e4562549e19448d77ea1669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603655, "uuid": "c2251994-1af3-445d-b7d9-b4a33d512560", "comment": "Malware payload (RedLineStealer)", "value": "6b1624efbf68f10bdab8d311a9b0d8884201cf8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603655, "uuid": "b7a90ab3-f623-46fb-835c-d212a7f5d1c9", "comment": "Malware payload (RedLineStealer)", "value": "d94283162faa48d6d23b4149c478d94caa028f479352b8469b1c2f78ced7f52cbf4870bbd96717fb32fdc6bd1be100df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603655, "uuid": "74656226-a1f1-4e51-bc34-7df25ad7adf4", "value": "T11DF3181B6418ECD5D9054FF2D9348B132233ED928E68F9587B8476075C9E2ACBCA0D7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603655, "uuid": "3d8e0bc4-041e-4f70-a285-507c163ea5fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603655, "uuid": "768daf41-9e07-4919-91f7-cf94da2a49a4", "value": "1536:ypk0uNiaY/L197GkqgHP5T+q2jiNyyN0zJ+rw3p7ncVw+m4TzlTLg9ItbBI4xZKf:yO07aYDuPORv92ww3pD/N6tH2hclm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603655, "uuid": "9242768f-ec64-48d2-9470-a9cbd69fc8de", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603655, "uuid": "660cb8d6-5bf8-4b57-86c4-13334fb61959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603655, "uuid": "74d71d68-67f6-44b4-b0f1-4ff0e8387330", "value": "c98f0728cd52a85325aefae0370b99ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171809e7-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628583744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583744, "uuid": "8e2d3ec8-871a-4c10-8eb2-246935cc78e1", "comment": "Malware payload (AgentTesla)", "value": "d7674428d2b9970b706165d4ab317c0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583744, "uuid": "32353225-94f2-4b72-aef2-e1531f2499ea", "comment": "Malware payload (AgentTesla)", "value": "03d462a965108a9d9a216c4e26fa222c3fbba2e649a0e3e2cba8609070c6caf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583744, "uuid": "2755f191-aabb-40d8-b364-6112c7846f8c", "comment": "Malware payload (AgentTesla)", "value": "056976cfdcc5285cf7c207c6d1467d3d60225781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583744, "uuid": "bfe0f9a9-5028-469d-a9d5-fab67c2ad5c4", "comment": "Malware payload (AgentTesla)", "value": "5d3ab06361979ca5f76fb8621cd55f74c3a7081d7731bfd8457bde961be417eb9b9f8666b888a1052314030e27aebce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583744, "uuid": "01573633-0f2d-4a70-b5c0-17fe0215a3cd", "value": "T1C8B4F0C5D18D2324C9E0CF365206F17AB6B4ED210516EB09F6C0FDCAB87A59DBD90E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583744, "uuid": "9add8874-1f89-4ef7-8ced-1bc70ff8a7d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583744, "uuid": "79da7bfa-b10b-45fe-b8f2-afd99c31cef6", "value": "6144:5VshYiCWXpsFU1X0Gg1U/S71ZzH5wJlM1FE2EdYs6WcES0q:DsmihpsFUp0Gh/S71ZLj1F1ENc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583744, "uuid": "8ecf6b52-e5a9-450d-b9c0-6c86606e562c", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583744, "uuid": "32ff3c63-f821-4f00-b395-722236a40773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583744, "uuid": "199ab717-4889-42aa-a704-897ea639dc20", "value": "d7674428d2b9970b706165d4ab317c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bed792-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HawkEye)", "timestamp": 1628600725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600725, "uuid": "e39f716b-382e-4e36-a831-1bdf099a61eb", "comment": "Malware payload (HawkEye)", "value": "e7228f0fdb6675e599fce2e7697e237f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600725, "uuid": "a99d9683-2adb-4d7c-82c9-475194a00a15", "comment": "Malware payload (HawkEye)", "value": "03e73adb2a943786db217feedb75a14e7ce7ce39b8fb9f91a0fec989d1ce9188", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600725, "uuid": "2f13ad46-0ac0-4786-9170-a7ef1cf8204d", "comment": "Malware payload (HawkEye)", "value": "4ee29bd4a9e6756326728a6d3a2bcdb504d01e6a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600725, "uuid": "0b1c3458-851d-44ea-8413-34c920fdba6a", "comment": "Malware payload (HawkEye)", "value": "85a97055635563e23ba45b6e9c79de93933219d7e85ad8dc94d86ba7118c0edbcb37e5bcdfe5d13472848dfb4964e0f0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600725, "uuid": "7ca514e5-9266-4688-8265-7a34de8485a6", "value": "T1DAE26DF0265448D2D79B8396B18A7E590263F0BFEBC62984725EFBF5176B3118D0D882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600725, "uuid": "af4e5046-b064-48ce-93ac-d4281d1c0daa", "value": "384:Fb2EbIs4KbTHxRHco/AZboqfUFiRZvzsyPgVAz59hqHLXisCa12k3cvM+aSkXn0e:pJ8xqHhA1oqfUFPmaHLXida12klSqtHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600725, "uuid": "f62f6878-a47c-4189-9d27-982158caf047", "value": 31314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600725, "uuid": "42135851-91c5-45fb-a5b5-1c1c1d6d728c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600725, "uuid": "77c85dc3-3063-4524-9aa6-5b6ec663c7e2", "value": "New Updated 20210810.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ea5a10-fa17-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628626233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626233, "uuid": "dfaed954-9212-4758-9b82-aebb55f1bc2c", "comment": "Malware payload", "value": "e2ad97e2fa7869fd19b8dff69f431b24", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626233, "uuid": "b57c56aa-24c2-416f-85c3-8fefd9c99fbe", "comment": "Malware payload", "value": "041def9971fbfe69b1ec7a3287682639c108f185f7c1ad1074c66a028333ab70", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626233, "uuid": "8b0b60aa-199c-45b7-8150-289418e5c091", "comment": "Malware payload", "value": "22dc2541ccc9553912070c315564e1099fca38d4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626233, "uuid": "4ad9a1f9-274f-432f-94d9-613fe64e794b", "comment": "Malware payload", "value": "2d060ec18cffc5c920cbc488c63b75ef8ed1299ade3ab5dd5234383e7ce782e7355858b479b79729060a3f34352075c4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626233, "uuid": "3f883128-a50f-4548-b249-041f32176a94", "value": "T1F3E423CED68285C5EF4E4C61AA75BB7A138E06D1BD0C68B790B7CF8D198D6C880D119E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626233, "uuid": "00d86f55-05ba-48c4-9f0d-58b97d5441c8", "value": "12288:gtsd/9pdX7Pnx3rZ85qyc61OKGeAGhWrTA267TKXzYIIxgONDEng8ripeQ:BdXFDx3rZazE2zUSTGz1Ix7oripeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628626233, "uuid": "ecfa670a-ec34-4114-978f-b8de89b3d5f4", "value": 672617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628626233, "uuid": "14c1bb95-89a3-41af-a83f-645e249d4db3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626233, "uuid": "6a7d613c-3c45-4c54-8a15-3b9f39b41b89", "value": "ORDER-L100821.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a7418d-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556757, "uuid": "1aeec225-5647-42e9-846a-09440d6ad1a0", "comment": "Malware payload (Gafgyt)", "value": "92ec80f82c5534d5097eec46abdd77e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556757, "uuid": "050d23d2-50e3-40a1-b9e8-9f58c59751de", "comment": "Malware payload (Gafgyt)", "value": "0464ee1e592ba309ccfcbef4b7e543dc2e699742340cdff43f9e7026cb311475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556757, "uuid": "73cd5a32-d862-48d3-93c4-a09c3789257e", "comment": "Malware payload (Gafgyt)", "value": "97dd34e32fc5a654414446b2adba13d777b05087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556757, "uuid": "2079cac3-0a9f-49bf-8fc1-27c02c84035f", "comment": "Malware payload (Gafgyt)", "value": "c33e9b760e69a6c79c42204581a7d90d86b33a874a2a5e36aa74fd81ba59a655a2d7f18342e9b25b49d022368d8bb353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556757, "uuid": "3b2739ab-6397-41d6-9294-9be7f39dc4eb", "value": "T14592E190A593456BD42D44FD039EA66DEE90EC023D0F9F8A23418EE3C877413EE51537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556757, "uuid": "83e31b86-891b-4146-ad9a-0d859272b0bb", "value": "384:MfPJbOpG7eAzLTF4oBfA9LEpEZzLcGHOGYmyVdtjrryWKLQLv1R8:0PhaC544oypEJL7OA6F738", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556757, "uuid": "1bbbe43e-de66-47a3-ba2f-9b9babe4b41b", "value": 19664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556757, "uuid": "7deebe84-5f54-4be0-95d7-6300e0f42d4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556757, "uuid": "c259f199-da3d-4c12-a519-953ff11cc933", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.17275.21920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad7ed5d-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628601171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601171, "uuid": "cefdc7ad-5fcf-4d7b-935c-4342c356f2c1", "comment": "Malware payload (RemcosRAT)", "value": "4feaa9ba960d321036e1217d400120a6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601171, "uuid": "fb31ccc3-22aa-4649-8215-31a221a1eca2", "comment": "Malware payload (RemcosRAT)", "value": "04beb3e7fecadc8f6dc0dd9b249a63fbf0fe23299300dad81fa30ed7edff6704", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601171, "uuid": "8aca3cc6-bf46-4568-ac3f-03923b351443", "comment": "Malware payload (RemcosRAT)", "value": "792fcad852230736d212f0618fbeb62b4d39a3be", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601171, "uuid": "83a5145f-abf0-4239-8830-9c4091b8c732", "comment": "Malware payload (RemcosRAT)", "value": "601da56642bf2b1aa8d5e515b15c7b4155241950fe3ef82f5b39528f3c10da10562acb3a706427b1690ef8461fe18265", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601171, "uuid": "5b5bcfeb-49b8-44ca-b538-1f14520d606a", "value": "T19A4512242ADAB623CBA60A70412BF40B52EBCE57373D871E5A173E2145B53BE4FC41E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601171, "uuid": "dbf91509-3a4b-46fd-a879-87516d053480", "value": "24576:6LEmie2qKvGe3SwOi5XPLARWuDW7pLBLCjrGVSCv:6jie2BGegeODW7p0u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601171, "uuid": "c27f2d82-f1df-4cd7-bf2a-68fa39a20ef8", "value": 1234568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601171, "uuid": "6968c38a-6db9-4a0a-82ca-10f677c33123", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601171, "uuid": "1b5cd140-8025-47ef-a2bf-38e09a0d24be", "value": "E-Remittance Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431b4d4f-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586395, "uuid": "2cc29fdb-383e-43d1-a099-3d620827d404", "comment": "Malware payload", "value": "d26101840acd8d8cc4904bf237eda4bf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586395, "uuid": "aa5f540d-c965-4466-9862-efc19dd66692", "comment": "Malware payload", "value": "04dc260c4cbb2c80244902c483d062470bd75b07fd7ba49cef9012bac2690fb8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586395, "uuid": "e9d02514-9321-4da1-b21f-5296cc305f2f", "comment": "Malware payload", "value": "79e551b423c69eef0c4cd1cb987a91f22f01cb0e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586395, "uuid": "e43de50b-baea-4a0a-8023-f19b29e1fa5b", "comment": "Malware payload", "value": "7009c1634bbcb8200b3c661792a63d7b00d7f31c1c1846190a6ddc3f2141e55d328c9f664c860792d863d6c98f59e100", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586395, "uuid": "d83d4c0b-fc0e-439a-b160-942a94ccf25b", "value": "T1FA0412DF2DB92CBDDBB44D5D3ED2208354C078E8E77E9E91B417BA111BE11E40C2A296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586395, "uuid": "cf458ec0-6669-45f7-9f76-e704dd20244a", "value": "3072:AJHHNb4TTqz0C/5DxR465vvGPWfqm5dJ5lEIEi2/cImSe/mhLyn2JvDTHJgE0uJz:AZ9z7JtOPWf35lEPikmBKhvDTHynuOmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586395, "uuid": "414eda70-d5ae-4c1b-a29d-0099fcf38de5", "value": 188070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586395, "uuid": "f25c3b1c-7884-4203-a927-f9538d731a24", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586395, "uuid": "4b8bc0f4-f749-4f5f-852b-13a4ce659370", "value": "PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09175c3d-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628576419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576419, "uuid": "c8dacbc6-01c6-4de3-a79f-63697f1f8351", "comment": "Malware payload (Loki)", "value": "5b73fe85493ab5de9f1fca6386854f66", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576419, "uuid": "6f87115d-0fdc-4fdf-b260-95092a0d6605", "comment": "Malware payload (Loki)", "value": "04fe8deb7fcd8197c15970a7bd846c6e12c9108aad2464570fd4342b64190e41", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576419, "uuid": "2bb36d86-ef6b-4249-9f82-b572b2a6713b", "comment": "Malware payload (Loki)", "value": "c4ab5b4c915cba9eda255be8a88702aad1aeec81", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576419, "uuid": "a01c2041-a29a-40b6-9c0e-7b8548d357e2", "comment": "Malware payload (Loki)", "value": "a233bd7d0c816a45a15962e4f66365ec4bfa1007f44de15f55efcdf12d6cf000d4f717dce01b58bc86d960b47bb73a5c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576419, "uuid": "08abfb89-b5ca-46b4-bcf3-2affdb951daa", "value": "T16A45121994FA9DE6D17FE8F420B1A021610D4D4952B8D842DB3E3B0BB37245E6FF2C5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576419, "uuid": "588dc3de-1f0e-424f-8f6f-6bf5ce5bedd3", "value": "24576:DNqc9fFS2ut0NJGgZ7oQOyOGbTEoZf+H1T/KdXvphYJx:DDfkbQdnOAUY+H1T/8XxhYJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576419, "uuid": "9ddd72a7-381a-4555-99b8-7b49354a92c8", "value": 1270680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576419, "uuid": "ed8a98d6-65ec-40f1-b419-77447543ebd8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576419, "uuid": "8bcc8b63-7f7f-4d4c-8d59-5814150ba077", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d22ca0-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628608483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608483, "uuid": "7a8b5f83-02d1-4005-aa88-721fd8f92567", "comment": "Malware payload (Alien)", "value": "1742936fc3118792758eaecef0991ea3", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608483, "uuid": "183200ba-70c5-49fd-b292-3ea934837c52", "comment": "Malware payload (Alien)", "value": "057809e3b42b8b7a4f437a8cdbed5f7b78da66127794f8a9bf4f686693544be3", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608483, "uuid": "9e02c922-de36-4b0b-901e-69a5caeda7d4", "comment": "Malware payload (Alien)", "value": "c939e399263a53f5e5e4563085e5ff85a7ab0352", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608483, "uuid": "bc162338-d2f5-4616-a506-6bd2a6b49131", "comment": "Malware payload (Alien)", "value": "e45a0d8a347cb5b01a68af8b2a5710005b2b0a8577e261bc5422ab1643292964831d53653607a506d34d43d9d0b2500c", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608483, "uuid": "479373c6-5f56-44b4-9b13-7fbc4492bc88", "value": "T1BCD5336A67935C09D1270236C2032287FC2629ECCDF5B6EF95B104941DEBD9A8B25DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608483, "uuid": "03b5c5fb-31f6-4554-a858-ec777e6de99c", "value": "49152:rPUYehPA5dhtJMZejNQLHmWSCcA0+RBKCRvwCXj0AxhAg6o:LUYexAbdMZUOlh9xwCXoAxhKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608483, "uuid": "7393209d-0e6d-448c-bf39-27427b33f2bd", "value": 2771798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608483, "uuid": "462b9ed1-56ea-433a-b489-0ad98ec1195d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608483, "uuid": "a45dc644-2d36-4c2e-8e8a-cd1cff3b114c", "value": "Android-Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8693d1-f9e3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628603917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603917, "uuid": "70167048-42f2-4b87-ab16-aa01e8c6bbfe", "comment": "Malware payload (ArkeiStealer)", "value": "0dde0a0ad30b60b52de6665002d8d71e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603917, "uuid": "0edde804-cb79-4444-9849-179b079493b7", "comment": "Malware payload (ArkeiStealer)", "value": "069209cccc0a25c38b18ef3078dfd2d9faa59fd0a1a51fb98d83b8ba54a7f439", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603917, "uuid": "968771a7-be3d-4d40-8738-16c4278c80d8", "comment": "Malware payload (ArkeiStealer)", "value": "c05d43d92538bcbb1f874d768e31655955e50676", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603917, "uuid": "e180119a-673a-4331-9b01-2d5b613bad7c", "comment": "Malware payload (ArkeiStealer)", "value": "3ffaa0d478abe700eeb02dfe7c1770411e5a9f874c40c0787d3e65a5a21d0007e907be17ffe07a6ff1b61dfec58f463e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603917, "uuid": "d182000d-b8a7-4545-b84d-fc4e1dd89a72", "value": "T1B9249D317A90F872F097017078ADDBA4F669FC706B20424727983E9E6E332D0677A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603917, "uuid": "a848fc3a-a864-4b59-97e7-10f5c4020073", "value": "e4e1e1e6e225074b287b0f65b50fbc7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603917, "uuid": "ca4b75dc-f301-4569-8756-69c76a435fea", "value": "3072:kXseovGW+KWkjfloCb5fm7YWnznCNeoBNTfC8IU:KhGtjflrZpWzCIwY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603917, "uuid": "e81992fe-bc6c-41ff-ab4f-abee0a538327", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603917, "uuid": "fcd6f2f9-4603-4087-ba64-c0f7b599e39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603917, "uuid": "eb11dd1e-8a06-417f-8ec8-fbd41785de08", "value": "0dde0a0ad30b60b52de6665002d8d71e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c00be5f-f9d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1628597576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597576, "uuid": "739733e7-1319-44b2-893f-029e2d751669", "comment": "Malware payload (OskiStealer)", "value": "7f05dc92a62ddd277baaeb55ebcfa407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597576, "uuid": "8c5b287c-e900-44ef-9c28-55cf541ac9ec", "comment": "Malware payload (OskiStealer)", "value": "06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597576, "uuid": "6cec920c-97d9-447c-916d-7f766e622912", "comment": "Malware payload (OskiStealer)", "value": "23c8c1a1a8d16180980f4b38a47832738f947141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597576, "uuid": "cfc72dde-5b66-4657-b4bf-0cb6b6d9cfc1", "comment": "Malware payload (OskiStealer)", "value": "b6ddda36c6c0922490c7a8e82b03cbc7e499501deddb13f94e065cbd4c3eef57ef9811d6c56c8803820bab08fb548ca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597576, "uuid": "3b2b740a-0488-4e61-a5a2-1af323655821", "value": "T13515010733806763C459AF3B5CD9A3A24279EED5CBA1E99D38823A3E0DF6B418D41753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597576, "uuid": "2c054fb2-4b9b-4e07-ad03-01bd63356875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597576, "uuid": "88cbc26d-84d4-405d-a77f-b3a57cc65f55", "value": "12288:oplvxon3qGaNHEyC9/oR9gy5ZHK7z1S6TNCTm9H1tVwH9gd0pod3zBts7Vl+YJtm:dPp9AR95SbTIg1Bd4od0+YzR0xz6KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628597576, "uuid": "9bc3feee-4ce7-4573-bc22-c809e00e290b", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628597576, "uuid": "7ca32543-18e7-4678-aa13-c6ffff180d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597576, "uuid": "cad9700e-2b62-464a-b715-42100460261f", "value": "NEW ORDER_78947533.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3508fb51-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628586371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586371, "uuid": "e1ac5792-eff1-4350-aaf4-9b3657f239a9", "comment": "Malware payload (Loki)", "value": "fa3879336266a329365a426b1f44b11c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586371, "uuid": "42aa00bf-23a6-4f5b-8c36-f9593234ef43", "comment": "Malware payload (Loki)", "value": "06d334f41ed923dbeb5f0e08cac8c0d30294ceeb709b3f17f6803f1b204df7e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586371, "uuid": "2baf258a-3fb1-4809-a2dc-0a6eac294880", "comment": "Malware payload (Loki)", "value": "010b399d2c69aad4dea7d594c1cc8d4cb37ace46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586371, "uuid": "34433904-e478-4b94-9d20-1b9314a40c43", "comment": "Malware payload (Loki)", "value": "003768ce47b10350962f1a2afe34222b87503aaf119f35a82c021b4e5fdc461007288b4cf5c8f59b5795679335289c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586371, "uuid": "a68cad24-6d39-4293-98e3-eb9bfc5091a5", "value": "T143747D30A790C035F4B712F846BA93BCA92D7EA09B2450CF52E526EE57346E5EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586371, "uuid": "cdc22fd4-c799-43d8-adc9-b7c83bfc4de4", "value": "10d590d1f4ed2f9a6fb903cd9f148a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586371, "uuid": "16c0640f-d46a-478c-9b6a-14eeb216520d", "value": "6144:fsctHtaDxmUZfDUCi97fA+bNgyHE1ZTibzaeLfqajy1O6vV:/HtEAhCi9TiyHUYbnHjyXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586371, "uuid": "d564bc6f-2928-4551-94ef-5fa750cf3b6d", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586371, "uuid": "4834b945-3dd3-4277-a48f-815e67bc3cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586371, "uuid": "08d52e8f-4ee3-44ba-a2c2-c64d1159398d", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313ecc0b-fa11-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628623731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623731, "uuid": "bf30073b-15d5-45e4-9bc2-859b9e2b617e", "comment": "Malware payload", "value": "ee2370e2a1a7f85a99ece79d33a51b6b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623731, "uuid": "58779a87-6b75-4725-ae4e-4a2fbd1dc756", "comment": "Malware payload", "value": "075352f0f8ac06163f06380fba36d778046e5c9ce3ffa15ef082f2ea1fec09eb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623731, "uuid": "dffa7de7-0780-490e-a398-b3adcb658204", "comment": "Malware payload", "value": "cfd04ada3f64ae25667fe63dac1a7908070559ec", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623731, "uuid": "9d29f442-7fb6-4bf7-9fae-521063fe2769", "comment": "Malware payload", "value": "74cd74e385a40edd4b9e7f94b79a8787b7c5b7fdb6844a49b781b40f7276a864e9cb2d7b4b7f1efb4007dc7c61f0609d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623731, "uuid": "4036225e-23d9-476b-aa8d-b1b4b4f2f2ed", "value": "T1D0D3F18397E0147ED07BA63059EDE3761A728BE475E4A3D32C10D048AC7666B0FC8DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623731, "uuid": "af6d3843-a9f0-4bc6-b3f2-177bb2d700e9", "value": "3072:Cdk1gubPqNARcwz7qCeCM0cuLuIQ2XzXcvIQ:PREARo0covQ2jsvIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628623731, "uuid": "a1f5af35-0d21-4e0c-931c-b3559ed95570", "value": 136623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628623731, "uuid": "4f8ca390-279b-4bdc-a493-a8ae798202a5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623731, "uuid": "b86c29e9-b80d-400a-a25c-7402bfa99cb3", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4f1d36-f9f6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628612475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612475, "uuid": "cfca9757-106d-4e19-8471-74cb3b2b458a", "comment": "Malware payload", "value": "cdbb08d4234736c4a052dc3f181e66f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612475, "uuid": "e0e3ccb1-d760-418f-8d58-a9c76032c645", "comment": "Malware payload", "value": "07e5f6d7ec7ccbc3d742658e9161d799934c6f7f6a3ebf560f361b4ee1730b6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612475, "uuid": "f8a47f12-f0bb-43ce-ac7d-06b5298bc4bf", "comment": "Malware payload", "value": "6801a805b6dcb760e8bf399a7d3ad0489fec7bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612475, "uuid": "12db39bd-105b-4973-8fb2-72f26ebefdba", "comment": "Malware payload", "value": "a58409b098cc30fcfce581a6620c32fa09217b291150b96b6ef3e3de233fe2fe806755e5c35f2b79a5ea30ae259b3980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612475, "uuid": "9028a352-e35b-4492-a83f-4137e50d4b6c", "value": "T126E4AF22F5D68036C2B327B19E7EF76A963D79360326C1D723C82D715EA05816B39723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612475, "uuid": "25ee8bb0-b92e-427a-866c-ce982803c155", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612475, "uuid": "f5277be6-16f2-4743-8ba1-aa96dc572e0a", "value": "12288:CBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aI55DGDt2:8cneJVBvXAvwRJdwvZ5aI55DGR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628612475, "uuid": "d710e745-ef58-445c-98b1-f9727fca5336", "value": 662256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628612475, "uuid": "026cc99c-65b6-41f0-a1d1-fa92df644222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612475, "uuid": "6d69c8e9-cee8-4cc5-a3dd-50f65b39e070", "value": "lfar.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01a0d80-f9e9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628606844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606844, "uuid": "3f39bbda-0db0-458a-9c91-7495c355278b", "comment": "Malware payload (Formbook)", "value": "7107c22585cca5ac62b9fe39dbd9daaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606844, "uuid": "319bb01c-cbad-4698-959f-7e76eee44690", "comment": "Malware payload (Formbook)", "value": "07f0dc41af2d35f2cdddc5e1d2e38b49db0dbfa7a80840633206c77002d019c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606844, "uuid": "12223e3d-e812-4f6e-bb7a-3d2a7e737360", "comment": "Malware payload (Formbook)", "value": "f0ec4ac5425b96d44725d6530527aae591f5ad57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606844, "uuid": "8e26ab19-455e-427f-a8e8-095914fd8b54", "comment": "Malware payload (Formbook)", "value": "442c70e4d50a438f69a53a5aea40232cd818b4d91caef1a5d7bfa4d0c114485f5c755f5a950e225ce89e41fd34b4017c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606844, "uuid": "d704c898-d283-4ece-8a2d-ea7ab6911bd0", "value": "T11774DF01B79BCE92D1295B7DB601AB306AF1D72DE296CBFB3E49019F0D9782D42B11C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606844, "uuid": "50d47c0d-c03b-4e70-a9c7-cb681097f57c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606844, "uuid": "4792d247-d361-4821-b0d4-cb4decd1f140", "value": "6144:yl9bet/TLOCbWUyoEmxIlhM0fwZ+4FMxlJ/5OCVdKrLfF0lYmuQ4pf:yYnyoEmxIlhM0YZ9Cxlh5OCi/cYvQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606844, "uuid": "bde0d3e1-653d-4b4a-9148-747caed7f886", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606844, "uuid": "2526b963-97aa-4b09-af59-27281dbe7f66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606844, "uuid": "3885a519-3836-4c25-bd8c-c8e111dcdf51", "value": "7107c22585cca5ac62b9fe39dbd9daaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc12a71e-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628601254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601254, "uuid": "ab18ff36-85d8-41f1-a089-388397a60d93", "comment": "Malware payload (Loki)", "value": "e34483b39452203dcdb1ea1d99236693", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601254, "uuid": "415756c5-897f-4ac7-ad50-08ad53e27865", "comment": "Malware payload (Loki)", "value": "09b14aa4c39ca985c7734f9c0f0a1573fb23b7fa84a8338a26f030b1bed4758d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601254, "uuid": "511f5747-2c95-4455-bcb0-c098f2b0eaf1", "comment": "Malware payload (Loki)", "value": "3d7e8f7dc4b6320a7498b938776a86b6df199340", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601254, "uuid": "f518ce83-c600-4cbb-a9d1-e3639d422e13", "comment": "Malware payload (Loki)", "value": "ee5da6db3d33a6aa9596d0547992f4b28b935a6c6d6bfdd632ae21d7189d00819d04bb4dd38460e28fe157fb28624653", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601254, "uuid": "56fbb0e6-c38c-4e46-bd26-213e03bb196d", "value": "T1695513C67F937B06CAE719301E1AC140B754FC87BA27D73153BCBA64397A4E11A8A25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601254, "uuid": "41243333-463f-41a4-8ae7-9fd12d9a93bd", "value": "24576:H+uUVgHP9s+LmVlz85aKDL3X4okCy36OIuaDUz7ennohx67ScrswI:H8gC+yVRGay3KCyqsfz5hYK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601254, "uuid": "feda9756-09f7-41f9-9b15-794d09b2a83e", "value": 1333816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601254, "uuid": "caf02391-87c5-463e-970c-1a4ab3df41b1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601254, "uuid": "6febef36-343b-4254-b276-0d215f5a143a", "value": "MV VINASHIP STAR.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432e0f5d-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556759, "uuid": "1767fc52-bd59-4300-ab7a-7dea6f862271", "comment": "Malware payload (Gafgyt)", "value": "f80f03b61a6c8b7888fa96037bf91364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556759, "uuid": "d6109780-4d4e-4101-851c-bb5871ec4d8d", "comment": "Malware payload (Gafgyt)", "value": "09b8556adfd43f041547f4bcfd44af0f4dc8ae0c2cd739e12f48f46609a0c95e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556759, "uuid": "ee31a900-9d6d-40cf-8871-4aef9f8054fc", "comment": "Malware payload (Gafgyt)", "value": "e7263be7370618ac520d2f5286bdd23818da1aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556759, "uuid": "07ca857c-3295-4750-ab15-69783e3186f6", "comment": "Malware payload (Gafgyt)", "value": "52863cf67a8d7ed3f3bf9fa4364f4ba18e9c50085b813bbe90b141c04ea1ec89b7ffabfd9822a1b6debe05f0690baa9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556759, "uuid": "03043fca-389b-4858-8163-2421ef51655b", "value": "T1AFA2D0ACF2D86786CE3E5CFE401A67100DB5E08232CD57AC53598F8DB91968F786A07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556759, "uuid": "ef1d8780-4661-4cab-823b-e837f13b97b0", "value": "384:b25A1M/gmXsGiZmCid3HlYxf6fS6lpmjyCK0hEsHVgSlDU3j5m2CIdMso1BWRWGZ:bwblXsGImPFU6flpaKGEsH+ShmNCSoSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556759, "uuid": "6a49e7d7-0238-4f47-bcd0-59ea3bee0f42", "value": 23164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556759, "uuid": "27dc5195-ffc8-4853-9ec9-6f27596bcefa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556759, "uuid": "04b2536f-df67-404e-a38a-40d0c477ee8f", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.17790.21624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea22a75-fa15-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628625605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625605, "uuid": "5d2b200c-eb99-4135-9db6-ccdc9ce5797d", "comment": "Malware payload", "value": "e9560a8852fb5058cc88dcbb6a14796c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625605, "uuid": "f9f825df-3495-4456-8984-b13b509c377f", "comment": "Malware payload", "value": "09ece919a018952bf923e290fbe576be1ecc78db1fd50c998bbd785219c6aea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625605, "uuid": "2ca7f777-6994-4a6e-ab56-f54e9977d393", "comment": "Malware payload", "value": "2cfb727eb366e2c9e5a896d63ccff51f145a25f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625605, "uuid": "7e838faa-d816-413e-a500-64fa4c806360", "comment": "Malware payload", "value": "86b08d5ae13ee231cc3b0e28f7188abf6f055f81108afd5778055e2e0ea9b29379c966a1a095963ca36652445c6ca3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625605, "uuid": "3e6127da-dc0c-44ea-9e44-f7021a9ae3e6", "value": "T1A405AC2814A94B67D679A6B7C125A354FFF05D637240DD0A4EA3F8C32E12B031A9ED1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625605, "uuid": "e0674da2-6748-4e26-a543-75c71f4a17e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625605, "uuid": "4299da24-aaef-417d-b8e8-0779adc57526", "value": "12288:hQJZN2sCDO4+yGJPt72RbNUJ9NzfhCAbuYjQ9NyW+tGmvB1P6Dj0bo9u4:WJZN2PDO4+ygCLS9NVbu93rmQj0biu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628625605, "uuid": "f918f30d-37bd-498f-9375-56f326c0a543", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628625605, "uuid": "1e8edb3c-6e93-41b0-a101-e4030c5df44e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625605, "uuid": "e4acb4c9-51c9-4938-9488-690343c2c042", "value": "bank account details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3b9c25-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628576424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576424, "uuid": "cb8452b4-c66b-45eb-aa00-fdc21e2c912c", "comment": "Malware payload (Loki)", "value": "53830c81c0e5b8e426900c35e4bcf75e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576424, "uuid": "630c8152-9a8e-4635-9f9b-232f536010f1", "comment": "Malware payload (Loki)", "value": "0ae67a6aaddf95483806cd9b640ad7b6cd02e787a00e6754dbc40033bd7e6274", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576424, "uuid": "10426aa7-d33c-4673-b5bd-46f323f536f9", "comment": "Malware payload (Loki)", "value": "b7343d9d6bb2caaf28ab4f5c75b5d48f7b2b2abf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576424, "uuid": "2518b537-a211-47f9-8ac3-ce92c5b534be", "comment": "Malware payload (Loki)", "value": "0dfc5d9d9d1b9a0cf205a85813ee17843df1cdd745917e1a1b373d316b06d3a8280761360f0b4ad714ceee18c7bcbf2c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576424, "uuid": "89bde0a9-826f-4d5f-bf23-6c2feb5639c6", "value": "T1D2451207B4873D2CDAB121F640528A55B71CEDAA6770B1906A0D3B15B6FF230C79BE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576424, "uuid": "7a8cf6f5-4e34-47f3-90a9-65b9dfcf947f", "value": "24576:b/85+oe00YZcw7dBUZWhN33K5hfNYcCea4hY7ipt4:bBoe0ZNrhRK5hlP/V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576424, "uuid": "beb97e56-9c00-46e6-afab-f0bcadf59f4b", "value": 1219864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576424, "uuid": "8470a33c-f1f4-4058-90e2-293b67f1264a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576424, "uuid": "656f7701-4260-4456-86eb-9320b77cd470", "value": "First Order Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36b5245-f9d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628598636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598636, "uuid": "73807ac8-2a4a-4a75-bf85-d64b4334e995", "comment": "Malware payload (Cerberus)", "value": "a33fa98242f62443e0304aa0c886e204", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598636, "uuid": "a62ea38b-82f3-4936-95ea-73ea18054388", "comment": "Malware payload (Cerberus)", "value": "0b018c290dbb5aa2af3f324f2a83c6654d5a47e4026413a6a082623bf2e35787", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598636, "uuid": "e4fff562-24b6-4704-9e4e-48e94c436542", "comment": "Malware payload (Cerberus)", "value": "7c0ec3f1f1610e266cafe77991404d53b635b9ec", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598636, "uuid": "b2397f5f-4570-4710-bc5b-cc9c0b8f210f", "comment": "Malware payload (Cerberus)", "value": "b04e71d38a9dea437865fccbee950eb3a5277fc1d426c34f39adcdb1f9233565b0f5ed005248bb15c80db47b25f7fbe8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598636, "uuid": "b3022ad5-dea0-499c-8f73-968b5df78c17", "value": "T1EDC5339A6B539E09CF6B523240477D93753A591C4BD9F83E093140E318BAE94CF21EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598636, "uuid": "f18ab800-fb0d-4957-a985-9415154ebc08", "value": "49152:vZ+BWZHq+s1pBFu0uls9FFFHc+MxwjHFkaZNG8jIuveCFv/LNIvArN+qh4Xyb:vcBWhBe97KwhbZAfM/LqIwMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628598636, "uuid": "92db8fde-622b-40c7-a9d0-45fe994de650", "value": 2696989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628598636, "uuid": "2c0c0e1f-3504-46c9-aae4-4524a682c0f3", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598636, "uuid": "001d0165-e245-4e08-936e-242857b8f04e", "value": "Android-Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e4b81f-f99c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628573756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573756, "uuid": "3568a33c-bbe0-40d6-9e17-e8fa2a1dd125", "comment": "Malware payload (Glupteba)", "value": "c9459eed4d7b0b155c0ae5a64748f5ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573756, "uuid": "3636215d-4bfb-4f78-a575-5d8821003fe9", "comment": "Malware payload (Glupteba)", "value": "0b07fe8c554ff364d42e3311b10a79ba6ed1b47e35763e45c924bafeb8d0d50a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573756, "uuid": "4429cf35-25e9-469d-88c5-1edfb7a1c2bc", "comment": "Malware payload (Glupteba)", "value": "05a75df014d108bf8d111db26caf34fffb4cfe44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573756, "uuid": "185e17d8-961e-487e-b687-6a0758e33401", "comment": "Malware payload (Glupteba)", "value": "24a0b67559f7a1cad181c8ca2ad65c394b731d5fb4b786c1d2c72540b405f100344a74a89476afe3513c78a6de716d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573756, "uuid": "53b04677-8bd9-446b-8a5e-329479e453ba", "value": "T1BF2633319660C028D4B771F44A7987A9593E7FA0772010CBE1E856EE0728AF9FD3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573756, "uuid": "6bd2d6e7-7a33-4045-862b-097d991e7b78", "value": "10d590d1f4ed2f9a6fb903cd9f148a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573756, "uuid": "5cd7af35-a028-4167-b917-432014986662", "value": "98304:E6opDexKJvw5yzIC28Vep1mZ4QfFjItKfbDrWJS0uyY:2ecJvo0ep124QfFjbbDrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628573756, "uuid": "9c38e71c-69a0-4256-8642-076bd40491ea", "value": 4739624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628573756, "uuid": "07fcc175-c418-464b-8f1d-bca543c3394a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573756, "uuid": "bfcae931-d91a-4c95-9ec5-e7b83407323a", "value": "c9459eed4d7b0b155c0ae5a64748f5ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0bebc1-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628561443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561443, "uuid": "e49d67f0-edb5-431e-a09c-6ad24061ec80", "comment": "Malware payload (AsyncRAT)", "value": "08b1c73d3d022072546c9d9bc84108cc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561443, "uuid": "1c26ce9d-342f-458a-b3e2-f4acfabe4cda", "comment": "Malware payload (AsyncRAT)", "value": "0b4d2e79bbaf1b0fff0f3c98e088e1253d4c5a74f3e914ff9bdd3f92280b1b8d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561443, "uuid": "76f43cea-990c-45be-9821-6dd42f84b201", "comment": "Malware payload (AsyncRAT)", "value": "3a23674e69a58bd2a0f54427247d48c55d603e45", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561443, "uuid": "7375a948-0987-46aa-be13-43ec13ae8700", "comment": "Malware payload (AsyncRAT)", "value": "206a5ad5521492ae98399301285db267250144a5d82d418711deb9355d69af9367d1bd17d6ea65c6b8d48b03fcd581f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561443, "uuid": "b592c1a5-f9a7-4ec6-8d38-45998445b7ea", "value": "T107039E146371032CD2F682B68A7733A09137F523A522C5DE5C806B5E19FBE4487A5FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561443, "uuid": "7bb14cd1-f58c-479e-8451-3153faaad3da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561443, "uuid": "03a64a9b-f23f-413f-94f3-eed5bb9761e6", "value": "768:6vnpJoeC1GimSKCwwUTsFLnK1vPmNl06X31d:6PpOeCWSK2UIp8n6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561443, "uuid": "ed705f74-50bf-4580-825a-3c938ac9edec", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561443, "uuid": "2be76fc9-1d94-4900-92fe-b0115dc51add", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561443, "uuid": "9d972a9e-d919-4e9e-a144-ca7899c7a74f", "value": "SBL8091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f009eb-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628608809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608809, "uuid": "ff2ba856-226f-4838-a22f-eb6a85e472bf", "comment": "Malware payload (RemcosRAT)", "value": "39a26e84308b1e2f61e46d1c4105f91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608809, "uuid": "77460a9f-ae76-4421-8487-c4b9dd82d247", "comment": "Malware payload (RemcosRAT)", "value": "0b4ede6ce80824c7bf66ecf5b42e1032c1039dc8e8b6e462d91be333fe9572e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608809, "uuid": "b7f693c9-fb16-4db5-bef4-6dbbad1f1ae7", "comment": "Malware payload (RemcosRAT)", "value": "e73a5549dd70393b966f5815fe3038f187e3d494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608809, "uuid": "f784201a-a10a-4c3f-861f-5e70ac00fc2a", "comment": "Malware payload (RemcosRAT)", "value": "d2ced9ad1badd6ae1ee113f10dfe794948cb4bde48c7c983b8a0344265b424fe24e732a9a4387b22a2ac8760419d20d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608809, "uuid": "cdb62e67-7b3f-4136-8c94-f48d19268973", "value": "T16135DF42AFF544F7D47A073104B71B306EB6AF201AB6965B57A0353DAD323436E23B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608809, "uuid": "5f5aecf5-24e5-49ed-b518-125f7e3d1c17", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608809, "uuid": "a8ad581f-2f71-444d-92c9-ed9628507bb9", "value": "12288:CQnk3GDYKGcblwywf8B8XaoN1WcYdxww26oq6TNLUfo27wfGC2beF7DvImwZNmrz:WAOcZwlfQ+WcYb66ZfwfhNQXNmrKFu+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608809, "uuid": "fbbfb466-6e25-4cf2-bf4a-a3b447af58eb", "value": 1142414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608809, "uuid": "710170da-61f5-48d1-9232-eb429fc5b206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608809, "uuid": "a90bf9f0-68e7-4463-bce2-f87f60dd525c", "value": "Notice to submit_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccaa106-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628583968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583968, "uuid": "b71354ae-28df-44ae-8a08-609ddaf5d227", "comment": "Malware payload (BitRAT)", "value": "c1eecde902cf9ae57bf9a0e1e25032e6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583968, "uuid": "59be0d87-dffb-4d09-99c2-408a8475cf76", "comment": "Malware payload (BitRAT)", "value": "0b6efdd0f3f4dddee58af21631051999c5e9d7968a3ba2e7a34388c42375a457", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583968, "uuid": "26cc11e2-dcbd-4a80-84a0-a073b8f67f05", "comment": "Malware payload (BitRAT)", "value": "0e373286f2da046c6912f25160e0912496d02d84", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583968, "uuid": "cb0d1f5d-b1e0-46b5-8c75-d41268664b0c", "comment": "Malware payload (BitRAT)", "value": "b6206e4149deaec7b3953f132657b38ec29036d904149a934aec08f44a7a4b2ec2c9ccffd7b19c220b29a9bd0b6d5245", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583968, "uuid": "8827cf20-f083-4e09-8894-11e6da5fcf49", "value": "T11406CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583968, "uuid": "a4704752-35dd-4e22-927a-2f556fc183f3", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583968, "uuid": "47b9ea15-9b3a-43e3-858e-fcaa3a099887", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/HmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583968, "uuid": "27193029-ffab-4ab3-aea4-bfdd3081d8f2", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583968, "uuid": "c7246ce7-e2d2-4c52-a1d4-b439df0e31a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583968, "uuid": "2caa1059-b47a-4a93-9a96-14194bc17495", "value": "c1eecde902cf9ae57bf9a0e1e25032e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a5a8df-f9f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611746, "uuid": "13f276cb-cefb-43a0-b25b-d6ff733c96e9", "comment": "Malware payload", "value": "ea5a7ad0dcd55d7835d3649b9dfcd51e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611746, "uuid": "f1d6fc86-1498-4a3c-9550-d68824599b1d", "comment": "Malware payload", "value": "0cb70c2842d361eff4d971e809911969086a71824cc422f98cbc8b924713463f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611746, "uuid": "423ccf7e-addc-48fb-a240-3865f8d74b4f", "comment": "Malware payload", "value": "cf6feba3fd6e5f0cf7cee84f4a216f33960e45db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611746, "uuid": "fc0c29b2-bbf4-4871-a323-8a06175c379e", "comment": "Malware payload", "value": "c1284fb2e56f8d44d16158672ca32f8d185e18c748e6430080ffbb69337c746a04beca4409a5c0c480d94d01904d3cf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611746, "uuid": "dda0dd9a-2dde-4b16-9250-b1019cd0346b", "value": "T11684231AD02A4260CEA6D7B3A66376B301E8DE13C81BC3C6DAE41F9D77573659CC2B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611746, "uuid": "3253c9c3-f28a-465a-80dd-492611970057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611746, "uuid": "d9577a9e-6565-4f24-9c88-d1d4d1144904", "value": "12288:5TIl1db2YCs2vycBplnjzafiyr3uLWgbROehqa:5Kbh1uVyr3bgACB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611746, "uuid": "72f7c082-7858-43f9-a13c-b9b9e91f225e", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611746, "uuid": "149772c0-1647-4e19-9f68-282bf8339c62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611746, "uuid": "c7bc591f-685f-41ca-887f-8b7eda9f4dfa", "value": "ea5a7ad0dcd55d7835d3649b9dfcd51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076902fa-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628600468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600468, "uuid": "09e013e4-6629-4877-b5e4-96f15c817d45", "comment": "Malware payload (AgentTesla)", "value": "e24c47ba37141e19d0343cddc0666f2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600468, "uuid": "508a1ccc-c8ca-4f30-bf0c-5ffd000074e3", "comment": "Malware payload (AgentTesla)", "value": "0dd4a217107132a83c2a17b9ee609dafcf3372a7b04e02421dade166c64a3c77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600468, "uuid": "7d2db843-f3ba-45c2-8db1-a6169c17014d", "comment": "Malware payload (AgentTesla)", "value": "79ded7b5f757f9f11d0c1674e18f6de0342c7ec6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600468, "uuid": "6fcbdb03-d923-4317-ba3d-887df1ec2c53", "comment": "Malware payload (AgentTesla)", "value": "45b5af0659d91e0ea200005c33bb6da2ec2e5ac3019b164fd7a38be66622a90f91e5bb99d8e077d766ad525fec240270", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600468, "uuid": "9ebe6b2f-6922-43d5-bce9-b891a66196e8", "value": "T1D605024723808393C415AB3B58A9B38306B4DAD9DB91EEED7982752E1DF7701CE06B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600468, "uuid": "e56c0871-a1ba-405c-9737-6dc1552b573d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600468, "uuid": "01445384-88fa-4ec2-9b0c-12a0940f7ad3", "value": "24576:+aKbPp9AR95yayNEHYofwgKspbHUCwCOd4:qPpKRyaOEfweArx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600468, "uuid": "27fe8fb6-73a5-4894-b113-d6bd4b0bc157", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600468, "uuid": "ec2cbfb7-8718-4c26-ba4f-30ef678b6039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600468, "uuid": "6e8d3c50-1681-4b98-958b-c10eea1c2819", "value": "MEGAHILLQUOTE08092021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74792284-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628603228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603228, "uuid": "9685f661-e9ec-4f7d-9831-50cae145ad45", "comment": "Malware payload", "value": "1d71373adf7d016bca9c36230bac3e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603228, "uuid": "14a3749a-2df0-406a-9eb9-6101436eadc2", "comment": "Malware payload", "value": "0e0340bca937a0ec255809107633ecb3d42323d41058071a9dd6225288903ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603228, "uuid": "fa769718-c0d6-4ac3-9eca-edb07b66688c", "comment": "Malware payload", "value": "647210935a57ee45ed6dd384265272e1e6a71b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603228, "uuid": "4316f2ab-ade6-4686-8f58-2c9baa76173b", "comment": "Malware payload", "value": "496526723bfd9168f251d3c66d40674fa07c8a295222c4ad7b5cc8ee6b53f1ca986947d0baec85012bf5fdc51b124ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603228, "uuid": "82c9cb3e-a0ed-41eb-8839-ab35c60be8a6", "value": "T12DC4BE22A3E84228F5F70B75BDB451519A77FD9A2A22C71E345C720D0FB378486B2763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603228, "uuid": "8ef69daa-976d-48ac-917b-180eb22a56a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603228, "uuid": "f7a49eb8-e060-4c77-a1ce-07aaa011ca49", "value": "12288:WoMNMgptMA/ZwBW3tOOPQ5zTvwniQinDbie2iN96:QpOmZwBWdr45Hvwnc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603228, "uuid": "d3777bab-40bd-412c-af32-bbb1e05e524f", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603228, "uuid": "3a289311-4d5e-4a9b-90ab-c2c86fd293dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603228, "uuid": "89b469bf-b7da-49ac-a11b-a7d5e364e49e", "value": "1d71373adf7d016bca9c36230bac3e08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616e0220-f9e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628605773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605773, "uuid": "94c66d2c-0560-4751-8381-cbf73d6711ca", "comment": "Malware payload (SnakeKeylogger)", "value": "959d99e82bfcff242d4033435dd3ab32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605773, "uuid": "51740a53-4256-436e-ba35-35e6a85cda99", "comment": "Malware payload (SnakeKeylogger)", "value": "0e77d367c706963bb393e99c935c129c66e0f71d70f5836b4abc9c8b91a25425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605773, "uuid": "f94dc82b-58b9-41b9-ad85-cc8c58ef71ec", "comment": "Malware payload (SnakeKeylogger)", "value": "72c3698e242bd733d2bf22f7581f8026a6f51f73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605773, "uuid": "228d8cce-1cb8-47e1-b7a4-32c723c61882", "comment": "Malware payload (SnakeKeylogger)", "value": "f2c56703a30834b681c5f3cf73ba8913b5310c5be7dca285fcb40d687236d348cd871c21b324599bd72ec8420f5863db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605773, "uuid": "219327c9-ffa8-47ea-8c01-f2eb883b393b", "value": "T16305024B27805393C4059B7718AC635307B4DAD9DBA1EEE939C2742E2EF6701CE16B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605773, "uuid": "1608bb13-5504-40f7-8e68-cd993bd4b2e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605773, "uuid": "1a376062-f908-4951-a75d-d84202c99ab5", "value": "12288:kzKKrn3qGaNHEyC9/oR9gy5FHK7zWAuZ2xcOYqOEHeMKaAohVkd4hNPunUUUWLHi:k+KDPp9AR95yaIqOpfPLhVkd42UMsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605773, "uuid": "793b0b93-798f-46a6-86e7-b158bb30f6e9", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605773, "uuid": "c3cb59cf-fe8d-42e8-98cd-c91f7b7960e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605773, "uuid": "2976bd3b-3806-4a10-8b4f-66f21cb03e4e", "value": "959d99e82bfcff242d4033435dd3ab32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db14e073-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603829, "uuid": "34168434-aa5a-40a3-ae7f-7b116457ab7f", "comment": "Malware payload (Formbook)", "value": "790939840cb426b9f163776c2c478966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603829, "uuid": "93b8d566-1593-4537-8bb6-ac7c4aea19c8", "comment": "Malware payload (Formbook)", "value": "0ea81e325568a6d5c8ecde8ce0198dabe9553e237ef46b328240d7f51231d3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603829, "uuid": "4f512a05-295e-43bc-8efa-6f8a3a13d622", "comment": "Malware payload (Formbook)", "value": "d0ec41b2b85db2a4e874c14a16466f827e170027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603829, "uuid": "2c28d1fc-d2cb-4305-ba20-fe4311b1b23a", "comment": "Malware payload (Formbook)", "value": "598d5f6ce12b7999ec6afcbe4b1bf007010261ab625554e46a1c2a718ca57fed320bb21d898ad47a465cb24d9b71a516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603829, "uuid": "91927ea2-e112-4655-b220-a895a410d91b", "value": "T16605E0623781FB4EC63A4EB9C5425910DBE0D6775703E3C76CE619DC8B8EA858B23352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603829, "uuid": "45713a3a-5d84-4556-8f31-9075bb6ac342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603829, "uuid": "67bd33a7-3330-4cd6-b1e0-3926d041a40c", "value": "24576:8dnaNnWfVembCSq9dnxWlh73bwwI+hYnl7daP6a:AaN4VewM2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603829, "uuid": "f9a33381-6130-41a9-a300-45ebca46aef7", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603829, "uuid": "83645e1f-2f3a-44a5-9b83-f1be8986bc78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603829, "uuid": "3972f58e-9a37-41ee-8ecf-d237b24ea6f0", "value": "790939840cb426b9f163776c2c478966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59dedbe-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628585352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585352, "uuid": "0899c17f-3418-4f56-bc4a-1b0cad1b9dd1", "comment": "Malware payload (AgentTesla)", "value": "24ad3b2e17fac6718aa79f6c50ccd52a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585352, "uuid": "08746829-d73b-48d3-b765-614aba7a8fb8", "comment": "Malware payload (AgentTesla)", "value": "0efa3d2a8ad556fc9bcbdbe9808e9cfd0cb5c32df3905d4af49b20bd7b95e3ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585352, "uuid": "2333655e-07f5-4fdd-a314-875b55ac1474", "comment": "Malware payload (AgentTesla)", "value": "24c3f792d92ea5fd15e5e2b7434fa9e44a62efdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585352, "uuid": "3452d56b-1fc1-440e-b7ee-95b0a7297d7b", "comment": "Malware payload (AgentTesla)", "value": "d933723608fd8b8291ccd49be06c440f86291dc5b51f0c78cc3db945daecfb2a76357a3e59522f30f93b9c2f35254a07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585352, "uuid": "1b2d55be-acba-4a8a-bb6b-3ab990bc7c65", "value": "T1A505F1263741BB8EC23E4D76C8415400DBE0E677670BF7CB2DD609DC5A8E69A8E23356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585352, "uuid": "3ceeb445-017d-4a55-97d0-80db80e56c8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585352, "uuid": "5faf2db9-e41e-44d0-bcc1-4a1ac77a1765", "value": "24576:/KoIFzEfDVBYUvXyzRRSLe735UY69ZljggTGe:/EAD7YUPyFAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585352, "uuid": "1e736eea-ca90-491e-9e44-c3f17157155a", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585352, "uuid": "37c1e94b-6276-458d-bb2d-f06d6c412423", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585352, "uuid": "fa387916-69f4-463a-9313-b31f4a144258", "value": "24ad3b2e17fac6718aa79f6c50ccd52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49b302-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628576427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576427, "uuid": "9eed0ddd-3edf-4786-915e-7e9732d240cb", "comment": "Malware payload", "value": "798af3669f51d20dc41f23984ff9a20d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576427, "uuid": "6b45e263-2330-464a-8c15-bc5c02a64ed6", "comment": "Malware payload", "value": "0f1b478936db806ed594a5d6514559cae6ee2aaa88f21e8955354645e81bffe4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576427, "uuid": "7a28b4c4-5878-4e32-9d5b-4c8a70f50c0a", "comment": "Malware payload", "value": "b2acd5cc367c1d4e07a1615a5425c240f7f3124e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576427, "uuid": "214e4c92-27c3-44e9-b3c0-7af298f10899", "comment": "Malware payload", "value": "11a89a0310c906f21d4bc0720e765a028d757d720262a0ab66d52433a0c1346ca42a76bf2bae6188c498bf65e4cea00f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576427, "uuid": "dc03639a-0f31-46f9-9880-91ad168552e8", "value": "T1F791B47ED3B84D1BEE4A51E2CA35FC1054D2F25748CBB584322EE9A6076F311BD61880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576427, "uuid": "84c2d653-402a-48e3-a9bc-9cce31330a26", "value": "96:BDED6El0r9TSS7v7LFFPmcwbnCNAvKMbxgcOAVRC67:BDEDL0h+8v7fPGCMbx4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576427, "uuid": "e073f121-09f0-41a9-83d3-6e022c0e2f17", "value": 4344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576427, "uuid": "34e1d381-56d2-4525-971c-fa2b778b2c1a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576427, "uuid": "f77cee50-90d7-4e25-b645-a4c3b180dadf", "value": "PURCHASE ORDER - 3114U0-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7e709e-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561122, "uuid": "8abf0dcd-bdec-4761-9c59-4ef530bedd12", "comment": "Malware payload (Gafgyt)", "value": "d5990c84c54f52e5728aba2addf586b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561122, "uuid": "4aab6983-d07b-4f15-901a-763355dc43fc", "comment": "Malware payload (Gafgyt)", "value": "0f2d5f39e044a72e46f2cc065d2cc5125d82ea9f36521fa5c45d0e3e7ba21cc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561122, "uuid": "3c3c3aa5-d12b-416a-ade2-a7b01c44c52f", "comment": "Malware payload (Gafgyt)", "value": "0726d5df2b43971487c9af515dd742b9ddcf1932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561122, "uuid": "c8692625-fc97-42f5-b8c3-1d7af999dec9", "comment": "Malware payload (Gafgyt)", "value": "5ecfdb6077c101d0b694999d947dbacd243b900fd44aacb2f517a716de6400f1953de58008cae4d4bc6b78f76889845b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561122, "uuid": "30dc98f0-5114-4f66-8dc5-33b1d193390f", "value": "T1F5C3F705F8014767C2D327B6E68E4B8D3F3557E467CB33126A385EB42BC2B992D29D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561122, "uuid": "5f2f7c33-3d70-4066-9526-cc6723636297", "value": "3072:posaWhJgdWSCQ4TLFhSWT6iGToPTbTmVZqQ7Dk4EqXj5e:JJrgdWNvTLFhhT6itTmVZqQ7DXEqXj5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561122, "uuid": "bd0240b3-ba9f-4985-ad20-d63199e383c2", "value": 118931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561122, "uuid": "fe071911-a715-4ace-aac1-c69b0d074f48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561122, "uuid": "80471288-f648-4347-a1d2-8e16a652520a", "value": "d5990c84c54f52e5728aba2addf586b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ad8bf6-f9fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628614291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614291, "uuid": "01ef822a-c833-42a8-859e-0b047e5700b1", "comment": "Malware payload", "value": "57b388d86cf9eeac704fc629587c82bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614291, "uuid": "3575e5ac-f440-4191-abfe-b83e3e854e93", "comment": "Malware payload", "value": "0ffddce470010278a1e5545d5c616def34d6c4b21ac1152a11de5aa48792fb77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614291, "uuid": "44905ace-e3e5-487a-a575-f41fa7756d9b", "comment": "Malware payload", "value": "75b34c11d1efdcc6763a8290880267c59f5e497c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614291, "uuid": "7204f599-a226-408c-bc89-5ec1679bb0e0", "comment": "Malware payload", "value": "90b31bba9288ec0656069cfe27378ea44d1c55b38015e88f70b93b243605064e5bb873a02477f0e1d347180b79495708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614291, "uuid": "afa8c030-fe1d-484d-80dc-f2d08453a208", "value": "T146451230B991C035F1B712FC46B5E3BDB52D3A609B2490CF92DA16EA56342E8EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614291, "uuid": "9ec021fb-9853-4b87-b96b-4adc25fd4c37", "value": "e3cf60b4d5be6f57956398dd6440990e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614291, "uuid": "7883af5d-7f46-466e-b3ca-737827159c89", "value": "24576:BEXMeW1VIC29ja0qwyajfytMdDRdL8yBuSKj:u8ezrAwatMt7pBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614291, "uuid": "dba0ea19-4feb-4c49-839d-284d61a3395c", "value": 1210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614291, "uuid": "468c9397-e424-450e-a78b-a86f50a916df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614291, "uuid": "c7a00511-d0ad-4d0f-b129-9d7d7d7991e4", "value": "57b388d86cf9eeac704fc629587c82bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1647d487-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628603070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603070, "uuid": "8b4bf724-0e90-4e40-9cfa-812f6e853cfc", "comment": "Malware payload (TrickBot)", "value": "0f98f327951d3065e4e3c018179ad3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603070, "uuid": "445d2ff9-1f36-4c09-ae61-ede9899cbb92", "comment": "Malware payload (TrickBot)", "value": "104b914e642490aa18ec1b1eeeea70e288e7c6bbce699f37ac3ac8a2603a8341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603070, "uuid": "74327365-dc2b-4f7f-be93-fd5e16913c0d", "comment": "Malware payload (TrickBot)", "value": "ad7c31cddb843deb414f12bb5559a64bf749f10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603070, "uuid": "1ff3046e-3dd9-478e-87c7-aa6d9384a443", "comment": "Malware payload (TrickBot)", "value": "45a2acd5dddd0ecb5480e0af9618e8027f0e682ef187dbba2378137c89c238994d2dd81379e65cb9c80087152f964508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603070, "uuid": "16256a08-8041-4d28-bd8e-4a2aacd6603f", "value": "T1AF94E1313280E472F163107489AA8ABD5AEDBCB04B6015D777D42ABE0F747D1AB3925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603070, "uuid": "d50ed048-2640-4016-a7fe-656ba52904cb", "value": "e0b50ac12e1dfba4d95affb2dd541de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603070, "uuid": "761b6bf2-b03c-423c-840c-5f8872bc266b", "value": "6144:zjrzNW0NujooVXFXYqzygIWertnNQrmBPHU6fGkY48Y9sO:000ooVXFo6yBnNQrIPNGkYLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603070, "uuid": "f4a5a3da-50fc-4912-b417-db5c4f4a38ca", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603070, "uuid": "2e3ff01f-f3c8-4f65-af6d-2893820f48d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603070, "uuid": "6113bb73-99b3-4592-a7ef-5607b11a07ef", "value": "0f98f327951d3065e4e3c018179ad3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ccd838-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628601186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601186, "uuid": "0ac812b5-60b7-4aec-b931-a488c2c28f27", "comment": "Malware payload (Formbook)", "value": "63fc522758fd93538c11c5796686cfb1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601186, "uuid": "0dd36b01-2f39-498b-ba37-378bbb5387ec", "comment": "Malware payload (Formbook)", "value": "10c6544125fc37fbcb8e3e7221926bc90e78d26f5dc5b1a7478a1c812e6cf337", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601186, "uuid": "175993b4-c87f-4fda-bac1-a004d29be0a3", "comment": "Malware payload (Formbook)", "value": "e012b9139f666cf0b1ad4a6a7619dc1ab369c76c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601186, "uuid": "3e61337e-facf-4312-8854-0b5daad24d4a", "comment": "Malware payload (Formbook)", "value": "92493d5f434839a7614f012fd8d2386bebf5684b812c57e2842350a30351be23039e821b968d26ef78e9df774860642f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601186, "uuid": "72a8c05b-c530-423f-92a0-623025af7222", "value": "T1E335129CC6BF1B45F7B6303215E5345B501AAD08A6F1923FA701B70F6AB7AF0639131A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601186, "uuid": "69491e82-d24d-416e-a737-ce58a7d48032", "value": "24576:RrbWFfA71VwCkt3wi3Qw4urdQJATke0t7H1exg7OlTfIvYt:pbWBW1VS30nurdQJj7Hcxg7Ol7qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601186, "uuid": "51979b4a-2623-400e-9150-461646d22dd1", "value": 1159096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601186, "uuid": "f6c3e4b7-b2e1-4437-9949-4c4db495bb73", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601186, "uuid": "d9bbcb43-371b-4c91-be12-7b3258e84580", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cadd9ca-f9e9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628606570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606570, "uuid": "ff7196ac-bef9-45bb-b7a2-5a154124a5ce", "comment": "Malware payload (SnakeKeylogger)", "value": "04eacebdb55557a3ebef76c5ef9b68c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606570, "uuid": "19e544ba-7413-4203-a123-d591e63fc04b", "comment": "Malware payload (SnakeKeylogger)", "value": "118c359597e28e97538cdfc872032e8879955ec1168dffadd7a04bc8f703732f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606570, "uuid": "e532da8e-3ab6-4e6b-8d36-1a77292a74e1", "comment": "Malware payload (SnakeKeylogger)", "value": "72f545b388e79c47205c5dadbfad45f7096e972f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606570, "uuid": "ed7b36b7-97eb-48a8-825e-4721ab1db3d3", "comment": "Malware payload (SnakeKeylogger)", "value": "e416820bf33b90fff4627cd10275d09239aa88aff4d9fefbbc0a47f40b1e0d76f682a612b76255a7625de881a7b3a50d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606570, "uuid": "ec7fc759-db1b-4156-8f9f-362fbbeb35bf", "value": "T155F4E0667380BB8EC23E0E75C4815900DBE0E6736707F3CB6DE219EC568E6958B63752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606570, "uuid": "e45046d0-6691-4411-8071-9b9a4147c681", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606570, "uuid": "beecac57-b4c4-446c-aa75-71c52a7c5953", "value": "12288:WnYomyPVVsJGZ7ol0e/x677QYiRfU4ZdcazeWE2yWMFpb/96vWJg6HRjvcguSvNz:WncyPVVsuol0eYqe4Xc2Il96eg6HRjvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606570, "uuid": "27653a63-3cea-44b6-a422-4673f8a44e90", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606570, "uuid": "07575392-29eb-40e5-8146-8379e0aa9c0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606570, "uuid": "254ecfe9-105f-46b4-914e-62a801f683a4", "value": "04eacebdb55557a3ebef76c5ef9b68c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d077ad33-fa06-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619273, "uuid": "89155e6e-71fc-4c17-8042-3a9ce333e738", "comment": "Malware payload", "value": "6c642adbc5047e5a5e698cbdc10041cf", "object_relation": "md5", "Tag": [ { "name": "Bitdefender SRL", "colour": "#5D0CC1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619273, "uuid": "a19c7b55-f6af-4e3c-ac88-faddde4a8789", "comment": "Malware payload", "value": "11b320bead835f38bc205fb5a99783f0a2a886fbf510a82e71159bc14bbe4163", "object_relation": "sha256", "Tag": [ { "name": "Bitdefender SRL", "colour": "#5D0CC1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619273, "uuid": "8693b5e8-4872-4dd3-879a-f75f0d98dc56", "comment": "Malware payload", "value": "c53059bc0b532b39d07469f441c3942049f8a8c2", "object_relation": "sha1", "Tag": [ { "name": "Bitdefender SRL", "colour": "#5D0CC1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619273, "uuid": "49066c4c-7f77-41e2-a711-6547b67815db", "comment": "Malware payload", "value": "ece90b78e995119d8ab5f32c063d32d89722eeca9106133b739eb9df7fb3b411916dce136c40e54d9acf4e63ffe14419", "object_relation": "sha3-384", "Tag": [ { "name": "Bitdefender SRL", "colour": "#5D0CC1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619273, "uuid": "48b9d908-e666-41fa-81af-e1a43fb6a9c4", "value": "T1D4D63342A7C2CB92ECE20835B5668AF46C382CC9435074575F523E7BFA7136137A6E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619273, "uuid": "61174375-89bd-446a-9504-8cef8f96a846", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619273, "uuid": "3d431490-10e0-4ce0-b8ba-02ec395357c1", "value": "393216:KE95C1ymMG78D0008Oz871QSLO+Qa9+14Sj38Rh4eIu:Xz1O7XSLO29O4uhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619273, "uuid": "8f21bc38-ac8f-4741-9a3a-e4a67cdd7ddd", "value": 13589864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619273, "uuid": "c800573f-d022-4db5-a34c-accf2eed9fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619273, "uuid": "df145213-a0c3-4826-b669-d1fce1a86925", "value": "11b320bead835f38bc205fb5a99783f0a2a886fbf510a82e71159bc14bbe4163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe30b5e-f9c7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628591999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591999, "uuid": "c65a53be-3d95-4dde-9a22-dab2e2ae1633", "comment": "Malware payload (CobaltStrike)", "value": "9eea66590e4fa807516e6da6b22901ae", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591999, "uuid": "6f254b5c-e8b7-49bb-ba27-d357470f1cca", "comment": "Malware payload (CobaltStrike)", "value": "11be3a269a06b23158afb18561fb7c059f3105d1d37ddfec980899e296dc267e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591999, "uuid": "ace998ed-4c66-4fbf-9675-a3240f615853", "comment": "Malware payload (CobaltStrike)", "value": "8cadd6c6e940095133ca3442d8f6b7e46154f6a5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591999, "uuid": "51c1f8db-c98c-4fff-9e6f-d9dd7554f75a", "comment": "Malware payload (CobaltStrike)", "value": "f4890000a82617ef7d6254eaa90eb1cfc5540573b3735ebbbe0a647b611924c1a8905da74f013fad7655b4876887e325", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591999, "uuid": "4f2524cf-cd93-4ff1-899b-1ad31bb429ae", "value": "T1FCF313FC1DC671D3E6008570DA79A603F9ED92A6C0E453874A34B53A5CFDA19C92CDC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591999, "uuid": "7b6f5193-5384-460c-b29f-369584c4a4a2", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591999, "uuid": "601a0125-b40a-4cf9-9ebc-a352a442b555", "value": "3072:ZEoWeyJs7xePcnSV3nkq/eoiCxfeG1Mv5vYTGqJ37v2M0Gj0kj:SzecyxGJteoiOsRvYiqubGAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628591999, "uuid": "a5478650-3e9a-4621-bbc7-436f94d34cff", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628591999, "uuid": "d64daf31-d31f-424a-8d24-95521f6842d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591999, "uuid": "6e54fda2-e5fd-4d6d-ac62-7fc2fffe0574", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80459be-f9c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628590537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590537, "uuid": "8475de99-47fd-4bfc-a1c1-675ef13adfe9", "comment": "Malware payload", "value": "c7cac70725f22e0082403ac8378290e0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590537, "uuid": "7d800eaf-a1ec-4eb9-a38c-533633b5437f", "comment": "Malware payload", "value": "13520081052c832a1cbe729f7127444fab2642cc1134e3c8bfd7dfcc30128bd8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590537, "uuid": "0354d289-9d64-4383-97f0-aff510ebb816", "comment": "Malware payload", "value": "976b337d92f3232b26a29fa218166db48f24aca0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590537, "uuid": "bc0a362d-00d6-44c4-ae0b-d0c422fa681d", "comment": "Malware payload", "value": "bb74b335fef38062a18dc6b42854164ae0f0d45d2e52f318719f769b129d3d390fe16c935f465ff833bd58792cd1ade6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590537, "uuid": "8d176616-a490-4f89-8820-9db787fae50f", "value": "T153123B822B7FB8E0A2C125103756A960CD5EB16B4EBD71F55D6F660A202DF926FF0C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590537, "uuid": "d64e358f-1c6b-498c-af05-872787680622", "value": "192:CUSBa5payBaaUBaIBalBa8jBaBSBazBaSYw:CvINO56jXMHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628590537, "uuid": "64a52dfc-af85-48cc-b3fb-ee2934ea0520", "value": 9048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628590537, "uuid": "919a935a-0092-40b5-90a9-f6bf1ca09f9e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590537, "uuid": "8c7b4f02-b5cf-42f6-af93-dd630a1c36cc", "value": "Invoice-Spectrum-23521899.XLSX.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072e4f8f-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628603044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603044, "uuid": "e51ec2b1-c6bc-4ea5-8152-7af801475f23", "comment": "Malware payload (Loki)", "value": "971105834c1396764e165e3d60a17dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603044, "uuid": "042760aa-08a0-43b2-9bac-d3d9dcd805b5", "comment": "Malware payload (Loki)", "value": "14364f53431c5dbd27149d1d035ade72501d168f3d400a3ece11345a7c7056dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603044, "uuid": "54797d40-49cc-41a5-a1f0-f395a581d2af", "comment": "Malware payload (Loki)", "value": "2c76e99fa43f8edfacdebf55372ceea7948b0f6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603044, "uuid": "c7c95834-0ca9-4453-8f31-bd6e58c316c4", "comment": "Malware payload (Loki)", "value": "b91c2f9592f19a0f530161f66d70fd6eabf521124d5116dd6b45e1797acd07aeb7ef1104c2b10e6031ba83489a934b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603044, "uuid": "3542cd79-3617-4f77-9243-fe37f64aaa96", "value": "T18F05010B23805393C412AB36189DB3970A75EEE4DBA1DEED7846352E1DF6700CE56B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603044, "uuid": "75e8a1f8-6e05-47b5-9a63-df357eecb65b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603044, "uuid": "52a982b8-2e8f-4f84-b0ed-f288f01539e4", "value": "12288:zOKAn3qGaNHEyC9/oR9gy5FHK7zRbOSr1kTkHFWgHLoY+KPx2ilp9dfC+hs:zOKAPp9AR95yVbtrygFNVDlRfDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603044, "uuid": "5291beea-9452-4fee-afca-aac86ec96cd0", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603044, "uuid": "b26b2b7d-2728-4e1d-ba6b-6e40a16a6910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603044, "uuid": "a52f4aae-f6f5-4d46-a25a-ef65dc43e4c7", "value": "971105834c1396764e165e3d60a17dc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f303431-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628583462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583462, "uuid": "f0c8320d-730c-4c7a-bed2-82ec9a630582", "comment": "Malware payload (Mirai)", "value": "1a3475fb2e561b98f16c0f7f9fe40f9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583462, "uuid": "4a7a0825-251b-4def-b450-76a6d067a816", "comment": "Malware payload (Mirai)", "value": "14628cad1773d9bf7119c59bf6d25ade8fc4c31c723d3cce5fe6b8d394f502be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583462, "uuid": "5d6bc69f-da4c-40a3-a038-5bb4e245ff3f", "comment": "Malware payload (Mirai)", "value": "b8c02815c15e9ec6a131e7dbe3d338933b65fa52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583462, "uuid": "513aa987-a9cb-4710-9d76-fcdb3fc2e109", "comment": "Malware payload (Mirai)", "value": "4db90637917d465da7a77000918433d919cdd7f3c23bb4fd2f92625d64224fe5d8b2eb5672ba43c509e57ce90ec012bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583462, "uuid": "45349cc5-5e5c-44f8-a90a-bf49995dd121", "value": "T1BF530751BDD19A6AC5D063BAF6AE10CE3320B3E8D1DF3257CC101B157AC991F0DA7A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583462, "uuid": "77251779-1f7e-4249-afc2-e991d584f55e", "value": "1536:SAZDhA49eR0VRt6Kvi1tfTRGjbWEJ9oh+OimhM+r:SAZDD/1EePJ6ht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583462, "uuid": "464f5dd2-ba38-4ce7-9cb6-d7366e42c529", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583462, "uuid": "6fd74308-da2a-4d47-8d9d-41b9d58b71d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583462, "uuid": "0040d0da-1615-4946-85dd-e71658f5c7b0", "value": "1a3475fb2e561b98f16c0f7f9fe40f9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de82ee7-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1628608451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608451, "uuid": "3870c9f9-3200-4b51-b01d-a0589361bbd9", "comment": "Malware payload (IcedID)", "value": "31322a0941dc6c40c40e6ae817954e48", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608451, "uuid": "c01f903b-1d01-4e2c-b65f-d8a02843a990", "comment": "Malware payload (IcedID)", "value": "1469b1b33aa7feb7c0cdf521ec0ca75d55f6f9d82d5b4dbcd542b84493b8630f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608451, "uuid": "a3554ad3-138f-4302-9518-acfbfca1558e", "comment": "Malware payload (IcedID)", "value": "5912fef7d9116e7c41dc4dfe0a33874df687d49a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608451, "uuid": "aa55075c-c7eb-4872-9248-3c4a463378a1", "comment": "Malware payload (IcedID)", "value": "6493058542fcd37ec15696e85ff7b4decc1d29837f108191d1035537dcc327093df4956351b9e5dd42c6e81c0991ecb4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608451, "uuid": "be130ca0-feba-4107-b1d4-bcde048d0854", "value": "T13F03F844B291C617F26156798DD7C7EB3339BC0AAE01832B33947F0EBC796748A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608451, "uuid": "22e61f40-e943-4843-8837-66584a1a8c48", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZwp:GJKCBcEVA8pt/AB6MI2Ur/lVwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608451, "uuid": "763f0225-c83c-46cd-9633-8e47f7180910", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608451, "uuid": "292cf25b-ee52-4daf-9d21-66bd2df995b8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608451, "uuid": "c5b45515-4bf4-4fec-bf73-17b3cfac313f", "value": "31322a0941dc6c40c40e6ae817954e48.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69368067-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628608363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608363, "uuid": "b302b224-a5d2-4fda-b12b-18e7189fa46e", "comment": "Malware payload (TrickBot)", "value": "5a92cd49241a93ccc11b1065195ef226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608363, "uuid": "6b00df07-1808-4984-985b-38f9d4f5abf9", "comment": "Malware payload (TrickBot)", "value": "149092132cc1f8835218eeabb3e2df8affc26ec400827e237478fd5431aaf079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608363, "uuid": "a3060ca3-5cbe-4229-af89-6ff9198cad72", "comment": "Malware payload (TrickBot)", "value": "96366c1ffe9d1a0d129c688c7554261e970b1730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608363, "uuid": "216d9d31-0969-4653-a156-9c37a5e0c1e6", "comment": "Malware payload (TrickBot)", "value": "f95114986113c0f960b19e3cd49d9a98b2578fe24430a7f414e6b8d9848665731c35737900d2239330945656238d7377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608363, "uuid": "9752599a-0b5a-4a55-8ca0-7108c8923902", "value": "T19B94E1313280E472F163107489AA8ABD5AEDBCB04B6015D777D42ABE0F747D1AA3925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608363, "uuid": "76fba3c5-e4f6-4a88-bb67-894571709b34", "value": "e0b50ac12e1dfba4d95affb2dd541de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608363, "uuid": "3fd0e102-3d1d-4d8d-8216-432fd14d93a8", "value": "6144:zjrzNW0NujooVXFmYqzygIWertnNQrmBPHU6fGkY48Y9sO:000ooVXFb6yBnNQrIPNGkYLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608363, "uuid": "d80c9d0d-24b3-42ab-b839-162c96340d5f", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608363, "uuid": "0c37944c-df22-48a4-bef0-569cebce9571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608363, "uuid": "c418b11f-2559-469d-853b-91369db46283", "value": "5a92cd49241a93ccc11b1065195ef226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf7f583-f97d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560504, "uuid": "994e64a4-b262-4279-a74f-098ee897f951", "comment": "Malware payload (Gafgyt)", "value": "14629e6378911ebfcbb7518d7e6ec531", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560504, "uuid": "76aff2d2-cf4b-4b4f-96ba-4998070a57a7", "comment": "Malware payload (Gafgyt)", "value": "155274479e685c418a739c230bd50abe3e5d6a4bef6dfb7306883f7bca3d7c24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560504, "uuid": "857b8984-1490-400e-8998-a6afea6d1e61", "comment": "Malware payload (Gafgyt)", "value": "2aa45b4a022007310e2db640f1dd4f1a62751f83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560504, "uuid": "73bf2842-ea19-4629-966a-8f7e496eceee", "comment": "Malware payload (Gafgyt)", "value": "15c5a9b3fab46d15d85a95d9d916646407020a8f216fd4fce5e15c6605eeae6c4d57582ddc2d9899e37a1158f2729425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560504, "uuid": "a768662c-c106-4108-a886-c20af9572d40", "value": "T1EEB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560504, "uuid": "fdd8ccef-d44c-4cac-b19b-4bbfc35ac1a1", "value": "3072:MSY+46m1qOzsszFPPKNy+AmkZrQAhPDCXFke:06mgOzJzFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560504, "uuid": "6c237c4c-b4e2-4001-9c7f-1978759ce2b7", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560504, "uuid": "ffebadca-cb6b-4527-aed2-106a6ca673a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560504, "uuid": "2631e235-0647-40e9-aeff-0c822cbadeae", "value": "14629e6378911ebfcbb7518d7e6ec531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d331b899-f9e0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1628602957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602957, "uuid": "3ad0e215-6712-4382-870f-eb405dea827f", "comment": "Malware payload (KPOTStealer)", "value": "23a471d956410bc80dc0cabc006252f6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602957, "uuid": "08a2ab88-8c8b-40b0-9076-f4696e6a3bd5", "comment": "Malware payload (KPOTStealer)", "value": "15de5dae7a4b941d941f25cdb281c706714758f80878e47c315c5f3d1c8733e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602957, "uuid": "b9cfff2b-3683-495b-b38d-1ffa4a4ca771", "comment": "Malware payload (KPOTStealer)", "value": "dab043429ae0245be571450672b4c34270cb9518", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602957, "uuid": "b61be251-47f8-4bf2-9afa-e699d352bba0", "comment": "Malware payload (KPOTStealer)", "value": "f0fa6e9ec6b65509866f17e3bcfbded1faddb6065d61a31112026329a47a465e79a837544cdc10a87ac819e7719e95a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602957, "uuid": "33775279-3c5f-41ab-b54e-1a7fa2921491", "value": "T1A8D2D029EA25B830D6FB447A086944F4F27C4559B3A0FD89703D24EF426858703E37EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602957, "uuid": "c7a0b4f2-7c1e-4d8d-98d2-9087c5a9b49f", "value": "768:qHrfHh/UBZZ8xxh3+J6VH/pPdSEZI3qSNiV2k:er/NUBZaxxR+J6sKSQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628602957, "uuid": "d629431a-9c20-4995-ae4b-d3544570d318", "value": 28453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628602957, "uuid": "172c5b01-3b8f-4880-b1ca-7bb8603b04f6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602957, "uuid": "53fc19e1-48b6-4b4b-ace1-dfc2a1a25016", "value": "content.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3d0bc0-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628578545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578545, "uuid": "2927ba40-c4bf-480a-bfa7-2bf7580d6ccb", "comment": "Malware payload (Formbook)", "value": "20da0cd7af94c17e5d0f62dd8e71152e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578545, "uuid": "a2344fb1-48d1-4e3d-8be0-727be8ae22c2", "comment": "Malware payload (Formbook)", "value": "16cb5d00387369fa2bb69b16f39a62cd4dc4557324ac4202f466be7f6bec27d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578545, "uuid": "078237ed-5af6-416b-bcf1-11cbed50eea6", "comment": "Malware payload (Formbook)", "value": "088b8dd5efa917b333e32755887534fbc23b96d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578545, "uuid": "b58604c2-d4f1-4dbc-8286-01044e0c659a", "comment": "Malware payload (Formbook)", "value": "4084cf7c4002a176ebfb4788eef7cfe438e60d474328ff5a9bb0b25d42e15828d1958d88f41f11f271da7188b927281e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578545, "uuid": "249880ec-e473-46ba-a4ba-10072fffab6a", "value": "T191440212A71EC967C06344F261794A776AF737362B6F60EF4BC0182AF5119D1EA2072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578545, "uuid": "20e33130-2dc0-4742-b6d0-4d4d0c3b65d5", "value": "19abb3665ae1ff2bd877ad7bd730dcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578545, "uuid": "dd8a752b-3dac-4f26-8f4b-08d6f129d443", "value": "6144:sd53TvpHeIl09otSSAIAB15IIRWeVApXasSegXWm5wAUqrqcbX2e:sd53TvpHeIl09oYSTAB0IgSApqsdgGmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578545, "uuid": "52b38726-b0ac-4905-a16e-8671ed5a1dbf", "value": 257897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578545, "uuid": "1ee43c59-05f0-477b-bb48-30c32994a73d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578545, "uuid": "3ee27139-5bc2-4236-9644-63592157c5ff", "value": "AGG Orders No.76654746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa83d49-fa1a-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628627540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627540, "uuid": "ce797a58-8b0b-4361-81ca-744d7f42ed8d", "comment": "Malware payload", "value": "807f0f985e9e4f3e8f0bcd4f55edfe33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627540, "uuid": "a4a47f9b-626c-4168-9299-a727b29c1e14", "comment": "Malware payload", "value": "18557447ecf0465479dbc151e8b1370550f10211373cd738e3a67e9112927bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627540, "uuid": "33a5bd67-13a1-44d9-a318-cf87a786d622", "comment": "Malware payload", "value": "cda44708c3c8efe8d980250e791ee8cde1f7afc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627540, "uuid": "48367ccf-88ac-4c4d-a2ff-1697002452d3", "comment": "Malware payload", "value": "ddb674359c0501bee70da6775d09f1e91e56a857d54a6229b4f21a4d2e78b5749c17cc9d940f034caa2826a010b3a78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627540, "uuid": "b1b95dea-cc11-4473-9267-02f019ec2c04", "value": "T15A05E52924FF9127E526B2F4D118C646A2A07D9EA4C5DD2EE8B3344E4431257DF8C2EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627540, "uuid": "090d7686-abcf-4e6a-bbdf-2f6edbbcee48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627540, "uuid": "f946f25d-d121-43bc-845c-2db847225d35", "value": "12288:ErF379ZC7EbHCegVz9UPRdZ9fyWmqbA3:KhZDbfgVz9UPR9f9bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628627540, "uuid": "1d437d39-d1db-48d4-b057-ea640900c057", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628627540, "uuid": "5f050d8c-e9eb-4a4f-96cc-9bbcbb6514eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627540, "uuid": "fe408054-5b28-460a-811f-0875b6c226d8", "value": "usfive_20210810-214618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0dfee4-f99c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628573449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573449, "uuid": "247fc47d-6b48-4d41-a897-4598d1a4337c", "comment": "Malware payload (Loki)", "value": "49557755ac91d971c1d5d1dba37b72fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573449, "uuid": "9971db0e-6a2e-47d3-9132-ea1d8cb70546", "comment": "Malware payload (Loki)", "value": "191b83348581fcab8fa7108039fdc53e98f583ce52f65dd43cb2b336366d10f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573449, "uuid": "d68cf484-456e-495a-8a53-1954a0952db7", "comment": "Malware payload (Loki)", "value": "887f87c278828dc7b13aed992a07e12122bf2e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573449, "uuid": "250c686e-307b-4d3c-8994-3b1183092d8a", "comment": "Malware payload (Loki)", "value": "a9aacc86ac3e6cad73a6a5a99e362aac2d5d78594e0045832749230687164a45d549177601c84b8efbd6064760b4af51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573449, "uuid": "7fdebf8d-63cb-48cf-8336-2974ff5e2c40", "value": "T18F723B1277FD9B33D97D4BF859A253102BB8A207A852DF6D3DD550CA19227004BD2BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573449, "uuid": "6d7dbbcb-15aa-4e2d-a254-f7c825bccfa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573449, "uuid": "88a02cec-a3f3-478c-8bc2-70cc7771fd5e", "value": "384:4ybrmPI4c0LeVyQKdWW5oBvptXkaS0IFsNiMHL4LnPiHPjLWLXLeGjl3qWEfnB:4yh7xpB4asyXi7eGZqWAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628573449, "uuid": "ecfc027a-7381-4557-ae06-b66b9c22a614", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628573449, "uuid": "c111b17c-e7dd-460a-b1d0-dfdbda4065f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573449, "uuid": "b0810f6c-f9a5-4a73-99c1-350ad3a18e03", "value": "100021969 ELEM,FLTR,HYDR, MIC,350PSI .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193b27f4-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628600498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600498, "uuid": "55a9bb67-20fd-4092-aeed-46efc0fc659c", "comment": "Malware payload (AveMariaRAT)", "value": "3c2b4c82ab548b752297e6cb250ac114", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600498, "uuid": "d10c4fcf-0dfa-4044-8095-9257d753390b", "comment": "Malware payload (AveMariaRAT)", "value": "1b4347b37824a5228980b97f689240fa7f099fd6cab09878456b31673fb36acd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600498, "uuid": "8c7c0da6-e41c-4609-82a7-e2013394ada8", "comment": "Malware payload (AveMariaRAT)", "value": "370119ea96855a6934d020f3944f019890135677", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600498, "uuid": "83a9342d-2ae3-4062-abee-a066f006d3b6", "comment": "Malware payload (AveMariaRAT)", "value": "cb5c354d427fbcb3369248c3f8bb453159e77358e0f287b0bcf36919455ddc7afda21c882408826aca3c62f4b442b2ab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600498, "uuid": "2040d675-c4a0-47e1-968e-8835274e990d", "value": "T1D415F14B22CC9253C4199B36549963730EB5FEF5DBA2EA99384274EE1DF7F008D01A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600498, "uuid": "0ab5fd7b-8497-4639-909a-49d98b8783e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600498, "uuid": "2b840c6d-310d-466c-b5e1-bc4cc119618c", "value": "12288:vH4cZKRn3qGaNHEyC9/oR9gy5FHK7zcvjt73J8IZnarJmgoXaYfsxYRuiNr+MrgO:vPZKJPp9AR95y2tZhnim2packLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600498, "uuid": "d3f22bb6-99e2-4e73-9742-445d4dffbf3f", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600498, "uuid": "302292d3-922c-42ce-8ce9-622ed76450a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600498, "uuid": "131a69fa-f40f-479a-ba16-947ecb83fca9", "value": "THANH NGUYEN TECHNOLOGY - RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0281b256-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628581562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581562, "uuid": "6b650342-e2e5-4669-8ff1-51e9627811d8", "comment": "Malware payload", "value": "ee9a54fbfcdd984563f61ed1b4aebff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581562, "uuid": "9c90025d-852e-4f03-be31-7019b4e046e8", "comment": "Malware payload", "value": "1b5e8fe6497ea0b881c2cc8b8d93aee3e350f2570cd34fb3dc823e2e5b43e325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581562, "uuid": "8a201ab8-d2d8-4467-b467-26cbf984fd37", "comment": "Malware payload", "value": "83d718096489da4deb8d294b9f770c480cc284bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581562, "uuid": "ca509a15-84df-49f3-bc58-d225813c9afa", "comment": "Malware payload", "value": "95ff84a2aa5ad2a9ef6a33fb2a7d19a836add0b9a05b69ca5b04796c3a166ad7dd385f707b05b1a4c2f6b33a3c519432", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581562, "uuid": "b06cda52-5ed2-4d19-b3ea-325dfd176772", "value": "T1BE93D609AF510EBBDC6FDD370AAD0B0634CC655722A43B353674D528F64A24F4AE3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581562, "uuid": "966ba712-96f8-41c8-80b8-8fa0123aa18a", "value": "1536:GO9SliSjA3QTA+Z/3GyC/tjfGO40nGf+CbvupZcFY:GOvSyOAB7/VGO4GwLup/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581562, "uuid": "1f3bbc94-8587-4255-b173-edcd2eb9eb04", "value": 94956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581562, "uuid": "92f5f573-a7d9-4669-bd1a-7ec0ae582ce5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581562, "uuid": "97ff86f3-a4d1-43e8-be3a-7ddde35da7d4", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.16423.29200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5964b400-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (VegaLocker)", "timestamp": 1628577842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577842, "uuid": "d38311e6-d7ca-4423-b225-3624e1f4330e", "comment": "Malware payload (VegaLocker)", "value": "5de02f78f0770567af9c1394dacaff85", "object_relation": "md5", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577842, "uuid": "57ff0b55-384f-41e4-9950-6bcfcfff68b0", "comment": "Malware payload (VegaLocker)", "value": "1b6d6a929b270d3fd04c33dd11e0517bc96d6bc17f39ba9dc521e75209e1f410", "object_relation": "sha256", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577842, "uuid": "6fe2c0bd-1c6d-41c3-91fd-8431ca53cd3e", "comment": "Malware payload (VegaLocker)", "value": "789fdf4a4f55a8731b5726250d8ebd4603a64e44", "object_relation": "sha1", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577842, "uuid": "72a0e6fe-1425-4d0a-bdb3-9f5424c641e0", "comment": "Malware payload (VegaLocker)", "value": "f37e9c2110613d752fafcb74720fc284a512de7768503010eaa29976e3e545792df2fa9a081e77f794e737082a74f340", "object_relation": "sha3-384", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577842, "uuid": "46c2b69c-7d14-42ab-9a91-4e71e949a398", "value": "T120A423C06181B87FF15E80A5C0AF75C5CDCC23D7D8527E1292AAB7D7381E1AC984A5FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577842, "uuid": "85268c3c-608f-4070-8701-35d49e08ce74", "value": "12288:5B0pPmHU3N2V3t302NztsSjkiNEm2B3waQJJ:5CwHU3N2Vd5tsSjJNphz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577842, "uuid": "b4d9024e-7cd6-48c8-a243-7901a50ba356", "value": 484520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577842, "uuid": "bdef74b2-e62e-4899-b896-3f5367b78e53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577842, "uuid": "6466f763-43ab-474d-b625-8585d975185c", "value": "4085.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed66ad7b-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628574654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574654, "uuid": "7ba50693-314c-43bb-8834-503a031c9040", "comment": "Malware payload (Loki)", "value": "63daf591a4338cdf51c53fc63b2a66e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574654, "uuid": "14bbb7f2-b7e8-48b5-aba5-6006794cfbda", "comment": "Malware payload (Loki)", "value": "1cf9b819c1ad4771f76ba564223d010bd1eff0f396810dd48b1e3df4eeedca50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574654, "uuid": "3d87fce3-9f70-4026-9cb5-6ab7c16d5857", "comment": "Malware payload (Loki)", "value": "e9c8d30554f84827229461c5e54a1c3e0c0c7f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574654, "uuid": "00f26081-e23b-43cf-b361-e7f6186e984f", "comment": "Malware payload (Loki)", "value": "1c6291e12679da66da9c115f1319c750918c9592311b5a9eaea8f33cd082f7df2a4d5bad55e54cab6be8517e0fd2e924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574654, "uuid": "a94b8a17-a015-434d-8a4c-57c5e517e212", "value": "T1C1F4E0667681FB9EC57E0E75C0814900CBE0E6779707F3CB6DD218DC568EA868B23366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574654, "uuid": "44581aea-973e-4042-a04f-2c47ec65b22c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574654, "uuid": "62e9cb28-8354-4dc1-8a32-6eeb45862584", "value": "12288:9LPxKAbILqltsXqtB2/p+TFKpaca5CCh0MCRbYVKNV4pH5DBoFLsZwI7PBqygAHp:9LwAbI+wXqtB2/kQacECC+pRQ7pZDBoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574654, "uuid": "59429ea2-5905-49d8-b268-43efa67a9184", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574654, "uuid": "b34ba59d-6420-4b2d-8e47-fca7212f82fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574654, "uuid": "342b1ed3-9f5c-498c-b083-5012d38ed6fc", "value": "shipping documentpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b298a-f9c0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628588920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588920, "uuid": "ed19bcbd-ece5-40ef-9980-43f6d8718251", "comment": "Malware payload (AveMariaRAT)", "value": "071e8713ee6e7c428e15240aea0573ad", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588920, "uuid": "39410988-5423-467a-9b62-9993a635d77c", "comment": "Malware payload (AveMariaRAT)", "value": "1d32ff6ca20e64d999329dc9f4f9c9779039c46d9f65448e2299792046370de7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588920, "uuid": "cf98225e-9251-4291-95d7-04be5e1ca769", "comment": "Malware payload (AveMariaRAT)", "value": "279ff10eccde1f8d87bfa2c9f43b7a8d45f2e1f7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588920, "uuid": "beb62c2e-427d-4618-acdd-e089634a6a3d", "comment": "Malware payload (AveMariaRAT)", "value": "2d13c5bc42340205f7b112bdc64e5bc2d46b7b63b6ca9c685f9f2071276bdd6ac5e33e17bacaa3e90b22b3ef72411d41", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588920, "uuid": "48b55449-5d05-4eab-9063-fe6a281be1c3", "value": "T12AC4E0357981C0B3D966193008F5C6B11B3CBD319FA1558FA3947B3E8E347A3861AA6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588920, "uuid": "4f6b7cfb-1523-42c0-bf40-5585d91fe4f6", "value": "d4cc1601fd324eebfdf856765dda2bd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588920, "uuid": "805d1df6-38bc-4d30-94d4-55fe47e7bd1e", "value": "12288:jfDLDGoTfMLiJ+G3dVrSyea5N99BjCxsjl2VqsRHUpqoJpk:3XvJ+G3dNSqx9lBoF9Upq8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628588920, "uuid": "7945cbd4-f80e-4fbf-94f1-ce8f89b2027c", "value": 582684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628588920, "uuid": "9cd1d946-b202-47a4-b7ed-9fe49b5f0349", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588920, "uuid": "0505c8de-999b-4a7d-8861-08e99c343a82", "value": "SKGCTMG_758574857783759878934753_Carta_2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b58108-fa06-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619336, "uuid": "b6f3acc0-27a0-43e1-a234-cb6d31c561c3", "comment": "Malware payload", "value": "94ae7d840f6f41c01904e1a68e1d397a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kaspersky Lab JSC", "colour": "#333A26", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619336, "uuid": "b2c71480-8507-4642-9a51-c24636b7520f", "comment": "Malware payload", "value": "1d8fab2a1d9838f4273820a584837eb43a51813dfffa6c563b69526d93572d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kaspersky Lab JSC", "colour": "#333A26", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619336, "uuid": "35edd6cc-959f-482f-8162-3031df8c04eb", "comment": "Malware payload", "value": "41449f2121c971707f41621a2e3a79aa8932a345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kaspersky Lab JSC", "colour": "#333A26", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619336, "uuid": "f49263eb-6548-4213-9066-4e3e1d288d83", "comment": "Malware payload", "value": "2c167633cdc5a0181ecebb6273cb77f55e029edb13929a3c1c7f76bf41d2bdb347050ccfd2130f4ddd6fa5d1447603bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kaspersky Lab JSC", "colour": "#333A26", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619336, "uuid": "2ac451f4-eb66-46a3-afd6-6a4fdb6182d9", "value": "T1A5E47C21B2C1D071D46205382EF8EA7A4A7DB8200B214DEB73D89B7E0E717D25A75F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619336, "uuid": "8d550aa7-72b8-48fb-ab86-1f3583917ff7", "value": "9740ddf7fa8a089e815db268f77ba8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619336, "uuid": "05a78137-c864-4495-a3bf-249127fb2817", "value": "12288:76CsMwnCNmtPIzHUNrfMjRXHsHh5bPLCMcbrMpnd14kNkVCfoLuvkjGh:76C1wCwtPIOQg+McQ52VIwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619336, "uuid": "ef73c0aa-5de1-4677-b0b1-35aae74f34d4", "value": 696856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619336, "uuid": "4270089c-b43d-48eb-ab82-b2a76685ea65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619336, "uuid": "195da1d8-9286-4b3e-992d-3cc15a6e6d7e", "value": "1d8fab2a1d9838f4273820a584837eb43a51813dfffa6c563b69526d93572d61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bb855c-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628601238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601238, "uuid": "0dcb836a-0f7c-4d32-8764-53de03300603", "comment": "Malware payload (Formbook)", "value": "11798adc546b03b92d5a377bdcad9e30", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601238, "uuid": "f1660bd0-d4f9-4e3d-bea3-dbcb817a1920", "comment": "Malware payload (Formbook)", "value": "1e423da4c4f9bf99b86d8ff4476e5f9480923aca2d6786ca596b450836614b2e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601238, "uuid": "f9162d9a-8424-4d88-9b4d-72030a97a4b3", "comment": "Malware payload (Formbook)", "value": "4258f74aa997d3323372e5bccd3518fa8803445d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601238, "uuid": "faef697d-7c0d-4919-88a1-af161c733ba6", "comment": "Malware payload (Formbook)", "value": "1315c53f27b64135d07f997324b45ed6f87fbfc798ccaccf21537f65701de088f28c7c8520c91929cc53216f82eeb432", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601238, "uuid": "7d19c99a-9ea4-4051-b79d-535dd8625a7e", "value": "T1475522CAAB8146F5F18F0037171FB6D332F6BE94FB33D8092E5A7990B4B49D0A958194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601238, "uuid": "66c4be4c-db23-4268-a394-7658a66f86b5", "value": "24576:Oi9LXByE7GA9BH59/0pE71UttKrSWJIBlhPAai7tUgx2FMjid6mX4gsib5C+mg0m:P9AA9Bb061et+S9BlhPBeCgrmX4hqCZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601238, "uuid": "ceb3ed7b-cc7c-4c9c-b559-837b76e6c7f8", "value": 1289320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601238, "uuid": "57339799-f720-47f7-bde5-4dff272a3e8e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601238, "uuid": "974b672c-81dc-4eac-b34c-f157ebdf4851", "value": "SHIPMENT DETAIL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e48ea29-f9f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611754, "uuid": "5df23646-e03c-400b-b5ab-bc20bac6e95c", "comment": "Malware payload", "value": "bad8d6137259ef83582abfea9f4b2f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611754, "uuid": "c2da56d0-fe04-4bca-8707-261c55ef5b34", "comment": "Malware payload", "value": "1fbc3ddcd892c868cab037f43fcee5cd1dd67f5ce0ac882d851603bdc934ec43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611754, "uuid": "eb2b5b01-3ea9-4de2-9dbe-324fde732417", "comment": "Malware payload", "value": "06af0f72796e977537be7235960326137e1cb821", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611754, "uuid": "cb9b4233-33ee-4edf-9a20-2fa10870aeab", "comment": "Malware payload", "value": "9fc087c0e31465cb8f12e4a9ed714da5fea5408421549aff996df9bb99069ce976c4568f8f8f00ff9fe155712c5616da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611754, "uuid": "f03b6143-4ff9-48ca-acc0-7687ae38c278", "value": "T1ABF422095A1BD262C2D08733D4E0AD3C43F5AE83B5A0E41B68DD7E6D3A33395B6D858D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611754, "uuid": "17becd9e-dd81-4efc-a06c-cf11ea40bb8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611754, "uuid": "d20e5569-5a5d-4441-8577-43395b03c1c4", "value": "12288:QzpM6vs9z8N5ndgaIgAz0ioW608I5dgytMveLBxuff3p3qyrOQKCFLSjTMJxtU1:m7sK5maIgdioWCI5d9keLBxuff3p3qyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611754, "uuid": "9b88c9d6-89d7-431f-a5d3-900d0811e15f", "value": 751600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611754, "uuid": "15d2caab-dc9b-4b73-92dc-bf526fcbc804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611754, "uuid": "d8684f33-faf8-4eb7-8d80-123d0d581f39", "value": "bad8d6137259ef83582abfea9f4b2f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a32a9a-f9a2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628576383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576383, "uuid": "35b7d355-cc21-4c06-83a9-bce65af9b38c", "comment": "Malware payload", "value": "28502614453873c3778d6c65f2decdaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576383, "uuid": "ea51153e-c86f-4b65-bf31-e4dcc8586735", "comment": "Malware payload", "value": "210e5253c61ecf12ff9e8ba186db8b3381cb15d42e8afe493e7ea7781371854e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576383, "uuid": "886e81ea-944b-496e-ae75-485c10a670bd", "comment": "Malware payload", "value": "50c41acd37bc3709ccfe1d23cf816b220eb5c17d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576383, "uuid": "2d373da9-07b1-4fb8-a647-55840d97f599", "comment": "Malware payload", "value": "bd5141610f6d1bdf0c92377a3b77b3248f7efbcf665ce1b8b0c0adc709e82edec9dc5df9c0eed24e1399f61dc91e14fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576383, "uuid": "1bf6f62a-89c1-40a1-ab3d-ac4b01a42686", "value": "T103D50910E721C529F89B11B399BCA4AD4D6CBC304FD960C3B0E576EE167A7E12B31693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576383, "uuid": "cb31dc4e-1d29-48c1-b7f0-fa7418d72c5c", "value": "b1cf9da3c229ede72b625108005108cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576383, "uuid": "8f4c0e00-395d-4ff4-9959-c474d8520dfa", "value": "49152:8HAaxKbq9sa0DYZ+/Sq0Osehf28ZZZZZdNEcwRZZFZMZJZd2Z8Z9KZSKZLZZF03B:lC6XqOkm1duihF9WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576383, "uuid": "c17e3eb5-f535-4be8-aa62-b3d444f66833", "value": 2981888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576383, "uuid": "dbc507c2-0f25-41ac-af46-560d6e8b84e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576383, "uuid": "6489b31a-501f-41c7-b978-742debffe88a", "value": "28502614453873c3778d6c65f2decdaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742d47ba-f98d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628567149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628567149, "uuid": "5c5e6d70-49d5-491f-b52e-fe70922356a7", "comment": "Malware payload (Glupteba)", "value": "7b9affe73926b479729c32eec32306f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628567149, "uuid": "be16e215-0670-40bd-a477-a5a6ea438aee", "comment": "Malware payload (Glupteba)", "value": "21391fc51c85957fb1bf530fbdd01b9cc6b855445c5ae6e46d9be51441ee62f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628567149, "uuid": "aa139da8-e38a-45e1-806c-fba1075d3598", "comment": "Malware payload (Glupteba)", "value": "eb386238f8e1ddd63b0d1b92e73a051e3dc00914", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628567149, "uuid": "538b3a21-3b5a-42fc-a802-8d45f10ab0b6", "comment": "Malware payload (Glupteba)", "value": "5175a37ca838cf7fa0293b2156e35d117bbf563d165c4d26d7c09b310353be4c2d576882f89d7208bf67a99a1cfccf46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628567149, "uuid": "8045db11-630d-4465-b455-838437ce8116", "value": "T144263320F6A2C039F4BB11F45A789368383A3F608B2450CF93D529ED96646FADD7075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628567149, "uuid": "d5b3be8d-20cc-4573-9cc5-c5826eefe17e", "value": "6dacec1c54365d76351cf2216eab7641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628567149, "uuid": "3bee9e29-6f2b-45a0-8543-86597cff1878", "value": "98304:Bh00Ggu38pYDjm9fHTRWvAP9IAiz+qzqPaOoZ/Pcw:BhYgu2ZY8IAnjPaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628567149, "uuid": "18aa5fee-69c5-49ce-9cdf-22f43cf9464e", "value": 4735016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628567149, "uuid": "a211561e-8d28-4627-8536-9791db0a9d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628567149, "uuid": "f84a3e2d-a618-4939-8a66-227db43689f9", "value": "7b9affe73926b479729c32eec32306f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c24700a-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628583457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583457, "uuid": "474c0e6f-a97f-4326-b5f9-af99cba43b4d", "comment": "Malware payload (Mirai)", "value": "251b2c185fed01be6c5edadf404a4eef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583457, "uuid": "6a6be5d5-6669-4b15-961e-56213b9eac09", "comment": "Malware payload (Mirai)", "value": "213d2f8b8577f5e53fe81f6dc06be609e40ea68ac583a819f23ea1b20302fe06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583457, "uuid": "6880a546-2be1-4339-8690-6a6860150606", "comment": "Malware payload (Mirai)", "value": "ea303c2d323528434ac41ae6b9a83f527dbae32a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583457, "uuid": "fa4f8956-2d94-4223-826a-2a601821b092", "comment": "Malware payload (Mirai)", "value": "9101baa19254b37ca1604e5c97dba5c455e5c0197ebfd76ac21faa96317baaac6aab2ccaf8820bc131d254f509850778", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583457, "uuid": "1e53341e-a1ef-4e25-8bf8-703f463fa4eb", "value": "T1A2E34C46EA818A13C4D5277ABAAF41893332D754E3DB73068D186FB43FC676E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583457, "uuid": "41a0f9e4-ee32-4d6d-a511-b4c5f2c3d036", "value": "3072:FHoomTyM0n9ZKferpCxfeJs9aKInz3lk4xh04DkyfzUyM/9r/harf:VoomTyM09ZK2ri2JHnz3lk4f0Fyfz5Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583457, "uuid": "8be0873e-0933-42ff-950e-eb910c173994", "value": 155931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583457, "uuid": "3bb7cff1-abed-4267-8817-601c9cb82ec6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583457, "uuid": "f636e7be-2393-4177-bf3d-3b900b0da789", "value": "251b2c185fed01be6c5edadf404a4eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424e7d3b-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628578233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578233, "uuid": "f9b8caf9-11bf-4dc4-b0ee-4600087786de", "comment": "Malware payload (AveMariaRAT)", "value": "aa9b3df465a8c0cdd9a9d3a3002c710e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578233, "uuid": "e56e2204-735d-40b0-b050-08704523b3f5", "comment": "Malware payload (AveMariaRAT)", "value": "24631d0bf4fc0d21fffd1edb43a1abb5965e5f099f675818500c848844df3451", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578233, "uuid": "f95c3285-5f28-41b1-8f21-97aa6f479175", "comment": "Malware payload (AveMariaRAT)", "value": "7565f30a3a07fa772c2895e5551fab5e4d345f82", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578233, "uuid": "6edd3cfe-a5df-44ef-9cdd-9ea5fa9e32df", "comment": "Malware payload (AveMariaRAT)", "value": "130e979092396ea89135e4bd1f64dc745c72d2c80aa591cf23b7d14afe1e86dbe0a22db34203d79bf70eaa9b89d8fb09", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578233, "uuid": "50e2e942-bdd3-49a2-95cf-7bb9a67ddc29", "value": "T16964230BE6296D9F7258A0E24DBC851A5AFE636F311504C0F6D2B07F8FD6DB218392C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578233, "uuid": "abb55629-6ff0-4769-bf48-20a07c8f049c", "value": "6144:nihM/hlmkMIvAM7tix2KpF5PdtfaKkCBilSn0e8YFy9TBUYuzJSoEDE:8ahjMIvAMoMKp3PffaSn0e8cAsA1DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578233, "uuid": "6317cdbc-b7e7-498c-8104-047b4da13161", "value": 319697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578233, "uuid": "bfab2525-5855-464e-af58-e45b617bcb8d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578233, "uuid": "d1d628d6-e293-4ca7-98a3-71ccbccde5aa", "value": "Document xlx.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3957d39e-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561467, "uuid": "8241b61f-60e2-48cf-b619-d6f5822c6ba5", "comment": "Malware payload (Mirai)", "value": "edbc6f56dff62e44054b7a8b41d02d9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561467, "uuid": "6aed06b2-c174-4fbe-806b-0d4c9f91f32d", "comment": "Malware payload (Mirai)", "value": "248c2172fda175f56856a6ef47edfcb5b2c1c6a47f0f8b5aa48ce70629e6363c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561467, "uuid": "9df4e692-24b3-4b1f-8e17-010276e08a3b", "comment": "Malware payload (Mirai)", "value": "18a22cf379da5206ab07ac2bd1606b0dc5978660", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561467, "uuid": "b27a228d-1ae4-4c84-9b77-7fd30127cc9d", "comment": "Malware payload (Mirai)", "value": "2e6985b3f19e3eb957fb439cde685b724db96ac4db40db3c82bb20e063918fc30898a656258994b4edbca076c7ae620e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561467, "uuid": "841d138b-285a-4add-b9de-cd8fa4901b41", "value": "T156430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561467, "uuid": "2122512c-03d5-49bc-9bb3-b88acb523819", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsIBXuL27PXhFBw:FH09gQ3jhBg27vhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561467, "uuid": "a49fe1c2-04a8-40c4-aa46-2c65f7315e35", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561467, "uuid": "0a80e46b-18cf-4c3e-9d76-088af3cd8584", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561467, "uuid": "09b98908-4fab-414e-ba8c-a6ad3469751d", "value": "edbc6f56dff62e44054b7a8b41d02d9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0188df57-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628581560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581560, "uuid": "d369be2b-2bf7-43b1-8429-54e3a4cb8fbb", "comment": "Malware payload", "value": "47e0207ba1c8c7b75e6abd7a921ff0c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581560, "uuid": "ebc19383-ec80-4a0c-b4d3-257c1fa19444", "comment": "Malware payload", "value": "256bed45839bdccec058f584363e2a74b3724d05d5d677bba26ff407070774f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581560, "uuid": "d2141887-d731-45af-baec-6254eb0e1fdf", "comment": "Malware payload", "value": "64a035c667e97b6ec6b2aa8e57553761aac79dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581560, "uuid": "c78b2da0-b4ac-4e0c-8b65-b8977a6f1591", "comment": "Malware payload", "value": "30aae6f9aa1788269fb1fdce418031c2ce8a0fdbe0d8acf938ded6fca8259102d85aa53cb0245c801f7613a47d936011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581560, "uuid": "b652878f-0d48-4927-bca1-d80948e53607", "value": "T1D3832966FC819B12C5D512BAFE1E118E33135B3CE2EE73129D24AF2177C696B0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581560, "uuid": "16831616-72d3-4c38-8f7b-89fd4c5c295d", "value": "1536:PBnfgWGVq0Kh4oIKYx+r4kF7u+iJ++bsL3uaiBi/8La8/Y3XI5oYYUQ:dY00S4mYJJ++bsruTIMagY3XIWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581560, "uuid": "9a6ca511-6eb1-443c-9eed-ff0959345ee9", "value": 81820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581560, "uuid": "9c0e82e8-b942-4ed1-9e87-e5cd3ac65e75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581560, "uuid": "30c9d392-3e6e-4678-89a2-0161c58d4e86", "value": "SecuriteInfo.com.Trojan.Linux.Agent.26356.8440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd1be14-f9b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628584292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584292, "uuid": "c16e377d-6575-44e5-a65d-777d7aa52e4e", "comment": "Malware payload (Mirai)", "value": "8da8467ece90dd64f5d7f17c8c7a8b05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584292, "uuid": "eb954039-a11d-4a9a-8489-bfba8d203835", "comment": "Malware payload (Mirai)", "value": "2585821a6f7c952a4fa6c099d915d2fd08e6b922b1a1e0b67fa89e2bbe7151fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584292, "uuid": "fe1b09f0-b9ce-404d-8c8d-3fce570b7ec6", "comment": "Malware payload (Mirai)", "value": "981bd76228aff670ed5cf4b95c0f9bd2b9e39749", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584292, "uuid": "936b7f75-849c-4c98-83f0-13d74819c211", "comment": "Malware payload (Mirai)", "value": "1b35b8d7fa9d7b42500a4180253eb67b0b94c3775622f7a9d665a0fd466e649cfd94baf2fb4a07b5cc656f5f10066382", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584292, "uuid": "8a2ba5cf-18c2-4a45-b42a-3437db18f38e", "value": "T1F1931982B8818E11C5D823BBFA2E118D331267ACE2DF72139D156F2477CA92F0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584292, "uuid": "a8207672-de18-4167-8849-308fd154f655", "value": "1536:dMpn3g31M79OfoMGfZN/BSdZAdSPgWeJRLaCXd16r152q7x5sCCc5cHozRIVitxn:d91MYf10rJSdWcGRLakQrb2qNBzxi0mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628584292, "uuid": "3df9322b-891c-4b51-8c06-36e206a36593", "value": 91444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628584292, "uuid": "3e3e2505-485e-4b85-8999-4da59eed2275", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584292, "uuid": "772c1a3a-d9df-4dfc-aaaa-6f491bf8a80e", "value": "8da8467ece90dd64f5d7f17c8c7a8b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3382f050-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1628576490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576490, "uuid": "99384a0c-662f-4ad9-a44e-2b0aa9ddfb10", "comment": "Malware payload (OskiStealer)", "value": "2377c2fb68272650616d78bd7a3ed3f9", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576490, "uuid": "22a5c74e-6f51-4a51-a23f-7b35583928cf", "comment": "Malware payload (OskiStealer)", "value": "258a576bd9abba2c1366f3124d808529a0232f61619f455d2277546172dec5d2", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576490, "uuid": "d019f2c2-6456-4185-873e-39cbf5c40b3c", "comment": "Malware payload (OskiStealer)", "value": "20eaa630d4eb06ae9385b5d46ab0d54180dc43e4", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576490, "uuid": "15501194-a46f-4fa5-96a4-1b373cf51edc", "comment": "Malware payload (OskiStealer)", "value": "fd209cfcd0941ddae52e5c2782bdcfa5f004e074545fe8a0d9efe1b616a4cfa8b00a5a418c41bc2871375352221884af", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576490, "uuid": "75db4813-8a94-4032-8e32-ff01508e32f1", "value": "T186A2D06366AC200AF03CAFB540BC27B1B9171BE9859677AF6196B1140385E934F2A4DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576490, "uuid": "f9dadf6e-ceac-4bf1-a22d-9c4fcb1e325b", "value": "384:dXP9Sec7G9BaI4C/37yNYgX+b/G0Exf880vV1WRTSb4K2pczIAZbChNWQJi4tLDl:VP9xWUz/37ynQ/G0Eh8vWSdKcztUNVJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576490, "uuid": "1103866b-22c9-4cba-aaf8-4c383e844ba3", "value": 21937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576490, "uuid": "e271be02-b911-4771-968f-2bee895d7d0e", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576490, "uuid": "5df91181-b6a7-4d1d-abb1-451a91f085a1", "value": "Rfq Proforma Invoice 865678.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eca549e-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628577905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577905, "uuid": "0bb2e65a-b788-44ce-ad16-bcf1a23ed7d4", "comment": "Malware payload (Formbook)", "value": "b1525dd93c9bb319b3be9dab3fa9c31a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577905, "uuid": "0fa2eb39-01e0-4b5e-93be-38e4688bca44", "comment": "Malware payload (Formbook)", "value": "26039e0d7ac0856375503044d4c336bce61c82ccc9665fe6c3bddc80a4d4ddc0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577905, "uuid": "e14af594-a1fe-4fcc-af66-d7c3624856c8", "comment": "Malware payload (Formbook)", "value": "a4b58df262e83902728d12d24283d8fbee3a8a56", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577905, "uuid": "f866fc36-b37f-494c-bcae-6d7be7a8681d", "comment": "Malware payload (Formbook)", "value": "bd35046a623ce42e5186be90157461766edeb48325e0ef5b5a4a0639fed350a7f06e55e0b00c476efa0ac2a3b8cf584d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577905, "uuid": "5e8acd42-c66c-4736-a987-2dc477806a1d", "value": "T1F0D423C3C08C3E0A3D272DB654896C464EE8FF94FDEB97BC47A5725AD034866700EA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577905, "uuid": "baac3651-dad5-4f21-8ea2-2784487e20c0", "value": "12288:VtSXjKDHljthqXpgc+UKMi2zPXHSc1SmImczCWK6B7koQI1Yro:VtQK5thqXpgxUw2ricQbmczeoLYro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577905, "uuid": "b46620a4-51be-4e9f-a5b1-b8533070d264", "value": 637751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577905, "uuid": "cd8ecd8c-5f20-412a-a860-43e4899b7a7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577905, "uuid": "93a84146-5dc3-405c-a325-a5a0e21a79b8", "value": "neue Ordnung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ba5322-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556762, "uuid": "4435536f-b64a-4618-a227-2ee37ea7056e", "comment": "Malware payload (Gafgyt)", "value": "ef9cc68cde6e76f5e100452d11b1319c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556762, "uuid": "75b0df1a-7342-4028-bf52-038369131cc0", "comment": "Malware payload (Gafgyt)", "value": "268d07009b050a1aff953a9fc405ff90332ca35f50f9a77482bdd9a8e2f8739d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556762, "uuid": "2ee265a2-de29-4557-ac7c-4afd709fa367", "comment": "Malware payload (Gafgyt)", "value": "e985599f7c49318177cbdf831249e8a98ab57aa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556762, "uuid": "6e7079a8-b09f-4973-a09a-b96e3ff4af83", "comment": "Malware payload (Gafgyt)", "value": "a2ed97462a2b4f2a094f5a8d0f740c8c486a58676acbc80fdb93e125033ea0df1ebcc590b697c5fa45db3785663033ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556762, "uuid": "e4ea939e-511c-48af-bcf1-31299d6f3f78", "value": "T127C2D0026190C6E7F931F9F8AA958343ED3A85FCD5CB71D3214E874436606D1E6EE983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556762, "uuid": "2c94ecf2-b49d-49fb-960a-d1ed9b25e851", "value": "384:3At/OJ0xLAS3nfd42BrPJMXWDEsm7h35rkrJ1FceVdSs3j3SWRWxch7qmdGUEpiK:AWL2nPB7F6TrkNT1VdSBWf9q3UELR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556762, "uuid": "1a469c40-7cb5-4a48-9f58-77efc92ac7b5", "value": 26496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556762, "uuid": "74cb8096-537b-46ff-90f5-d80c0c143bc9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556762, "uuid": "e521f00d-da24-49b6-8de1-92b19a150ad0", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.12301.14582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6957a0f0-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628583452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583452, "uuid": "41d2beb9-5094-4e54-92b5-d35f8d928a57", "comment": "Malware payload (AgentTesla)", "value": "4e52b88f2add7a826f961cff8c7e649b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583452, "uuid": "12f52b36-2d6a-47c8-93af-bb8b7e012e2a", "comment": "Malware payload (AgentTesla)", "value": "26a3cb6e0ec900f268352dc90556d9c67f7e25544ee1afbf39b9d389f7a84801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583452, "uuid": "a4c030cc-2b15-4a03-9a9e-979700fba6ce", "comment": "Malware payload (AgentTesla)", "value": "3681b274f05f3b97f21edfd745dc20a8d0c49369", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583452, "uuid": "02a3cf88-8a84-42e7-9ad1-20e159ccf549", "comment": "Malware payload (AgentTesla)", "value": "dbbf8316f481b386fb9de23b8628de1085ee21dc9197c6237ff07f11dbd951e01779af56435492cae05041368b5a0e9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583452, "uuid": "776244ed-1ba0-41c1-93ed-89b614319c59", "value": "T18805F06A3784AB8ED57A0F75D0025610DFE0E7779303F7C76DE209EC9A9D2864A23346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583452, "uuid": "97cabf41-7efd-4544-87ab-8f973a543e23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583452, "uuid": "8e50b6ea-147b-46c5-9bdb-8fbc6ca8dc39", "value": "24576:XfgCeUm76JKNYwU39bU6F4iyRu8XZhIbOH4F+tVn:nmMKiwU93628", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583452, "uuid": "6b67b749-771d-44be-88cc-831d6c713f49", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583452, "uuid": "9b3bd9d2-8c6d-4987-b9a8-eb5d56e2a667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583452, "uuid": "572625e7-f085-4b4d-a76f-8a4ea988ed1f", "value": "4e52b88f2add7a826f961cff8c7e649b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f65811-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628600710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600710, "uuid": "6902340a-324a-42ee-8955-1111dc76ce35", "comment": "Malware payload (SnakeKeylogger)", "value": "a3531a470b2a9fcf1db75a35fe1f3240", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600710, "uuid": "5cefc8c9-101c-424c-bc0c-257ce3fce2c8", "comment": "Malware payload (SnakeKeylogger)", "value": "274f9a100af82d26b43d9e6bb8109fc60cbe5f32cee4b7c20e1039ed537d5d9d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600710, "uuid": "9142d429-73e6-4c78-860c-e74e4dd0b5ec", "comment": "Malware payload (SnakeKeylogger)", "value": "ff0c460e3c57492fd8d181a04ba084a80f75d96a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600710, "uuid": "4c2ab6c5-d341-4b3b-bc4d-9f7e1fe57988", "comment": "Malware payload (SnakeKeylogger)", "value": "d4aaa9202851faefe94996f0fd6f98c764cc2d4520d75d74c830d4825e2d1be678a7d81f6d632b39ff1703a563d4d3ce", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600710, "uuid": "45f1f220-b674-45cb-82f1-c8036949a30d", "value": "T17023A36CC4A70A984F89A7B8AB2F9E85118D376DF7406632723C533527D5E3BA10397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600710, "uuid": "c244dce5-940f-4a18-98fb-8e7571bbb79b", "value": "384:nYFd85bG5kiaenFSCgWEx1syAWTOkYN3c:8UniaeFSOmSys3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600710, "uuid": "69df5c08-2f54-4cbb-aa7b-c64ed927f97f", "value": 46705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600710, "uuid": "41234264-da83-416b-a46e-09055546b421", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600710, "uuid": "9bda49ab-9a6e-4827-bb56-edd944f9539c", "value": "DHL Shipping Doc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2945d89-f9f7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628612781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612781, "uuid": "96e57b08-0fa4-4440-8121-c44291cfdd10", "comment": "Malware payload (Loki)", "value": "a20cee41b2437fbb614888d24971f29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612781, "uuid": "220fa1ee-85c9-4055-96dd-59ce6d26a1f8", "comment": "Malware payload (Loki)", "value": "28773d9e5dc1ef0fb9e3c09c5d1bd3f894270336387ef74866d3634d942b19d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612781, "uuid": "ddff8aa1-1449-4ecb-8e6f-030e4c89de68", "comment": "Malware payload (Loki)", "value": "f0d27e2c8210a26da298bfce056338f716e698e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612781, "uuid": "3e2a55a4-1c4d-4570-9d4e-007f5c0b46d1", "comment": "Malware payload (Loki)", "value": "9053ce7a1f42f2126f20d55dbcc423f2691d3c8b32a47b49f2ebde4cfa071c7f55522722088c4507e44f130db6286872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612781, "uuid": "d752cd1e-c1d2-44cd-b169-b5a0d31cb769", "value": "T1133512C82255B99DD5205E384FE1B5F2D2283E232E42692153CE7F1ABE34AE5DD113CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612781, "uuid": "4f875aec-07eb-4b93-b7e1-c75efbd221f1", "value": "f4afa9907318e4335a6c33177216fafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612781, "uuid": "1c5b3195-086d-44e3-8fc0-de3c4285e018", "value": "12288:aQ+3bG4kzZO4OhTx3JMXhWd3KcYrqiYwt7etMwWGwPbp+ODD72QLlAUeZ:U3bG4kg4OhTx32XhwYrqi2pfiDGslHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628612781, "uuid": "51a4b945-3ccd-465c-95d5-2de34192f874", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628612781, "uuid": "38ea5364-da84-4116-8963-911253fa1ab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612781, "uuid": "598a032a-529a-467c-aed4-eed335a441a4", "value": "a20cee41b2437fbb614888d24971f29d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4955164a-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561494, "uuid": "61b7073c-eb4b-4623-99dd-35f488c50c50", "comment": "Malware payload (Gafgyt)", "value": "3b0e857a199f62c6542806b74346617c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561494, "uuid": "4df910f1-3d2f-4d51-a703-a94ecae9bea2", "comment": "Malware payload (Gafgyt)", "value": "289c28078e84fb47f73525b2bba431dfc40ead9041a2b81af15a343aba7e9130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561494, "uuid": "8c8c3fba-d9e6-44ed-a27b-d3fa1d7bee5d", "comment": "Malware payload (Gafgyt)", "value": "7d3e68060f94b7fa6f9538b2764c1d90feb8c476", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561494, "uuid": "a5ff3d45-3e46-4e14-8182-46cb18bfe921", "comment": "Malware payload (Gafgyt)", "value": "ff1bba670d756c1c0f399773c67152130e5978c5c37c8548568e84f50562a6e28f943cdfa44ed4b058bc6a4b91fa44b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561494, "uuid": "33b0b2e1-f595-4311-a938-363aeaefcd96", "value": "T13CA3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561494, "uuid": "206d2b4b-02e4-4df3-baa1-aa2aa99f530a", "value": "3072:Vgdr2vIBAxMyAOLRcft5hOemuxVqDr78fz1e:Vgdr2vIRyAYcfhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561494, "uuid": "bc142392-f7f1-4fe0-88d4-5e7d08cf4196", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561494, "uuid": "7e33ce5d-2fc4-42e4-86e8-19dec310ad9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561494, "uuid": "ed99b834-8940-4385-a59e-48e26ee0a059", "value": "3b0e857a199f62c6542806b74346617c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fd73dc-f9cd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HawkEye)", "timestamp": 1628594687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628594687, "uuid": "4f87efe2-a8e5-462d-9ee7-7049b2e55aa3", "comment": "Malware payload (HawkEye)", "value": "5ea91377d8031fddf3ec3f0971bb2c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628594687, "uuid": "b889a781-da12-44be-8d4e-f02e785277ef", "comment": "Malware payload (HawkEye)", "value": "28e28025060f1bafd4eb96c7477cab73497ca2144b52e664b254c616607d94cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628594687, "uuid": "bacb76da-4e3a-4331-be42-ea4a51f91d94", "comment": "Malware payload (HawkEye)", "value": "87990f80ab81e7bc0e71a1c3e80dea54c3ed1769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628594687, "uuid": "2a217a9b-d511-4d92-84ea-b03e2df7c65d", "comment": "Malware payload (HawkEye)", "value": "4f98f1153d5b2768bbde454c90d7201662f25d7a8454ae8000190f0b81eb364bd3ec56621097583fe85e6a5f2b1f03c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628594687, "uuid": "ed122e0d-d3f8-4d84-81f0-88f7a6ab8173", "value": "T1BB3502197B80AB4FC27F8E7788415C10EBB1E65A170FEB875C8211EC598F7A98A43197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628594687, "uuid": "a9138d63-6840-47d5-bb26-7567032f7f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628594687, "uuid": "97813155-8531-438e-931f-de66bc1e112d", "value": "24576:XO1lHaOtyMd0539Gpd4buWDqHJfgRhzFb9SoCVCSMvhf3vr7aB:elHapM2539GXMJD6AR9SsSMZXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628594687, "uuid": "e6f3d2d0-e844-49a4-9e66-8fce80d428c2", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628594687, "uuid": "de48acc8-148e-4169-adf2-00178d79e3e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628594687, "uuid": "81144b5b-619c-49b9-95db-639c8c26f9d9", "value": "105498-A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fdbff7-f9a8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628578687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578687, "uuid": "d2be0e42-3c20-4f98-862d-3c00cc55ae37", "comment": "Malware payload (Formbook)", "value": "38f2090be746d6d7d13132500c283022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578687, "uuid": "a3fc73b5-947c-489d-a5a0-4435f99f919e", "comment": "Malware payload (Formbook)", "value": "29f3a920994225a5424f5e1710a9980710e4330f85aeade18182b5fbd5f2a354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578687, "uuid": "c4699da5-018e-428e-962c-b2158bee6cd3", "comment": "Malware payload (Formbook)", "value": "b142ea73b4f32e0a90853f35da2a8d92ec64c633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578687, "uuid": "c05b24a7-0d4e-44c0-aed8-77eabb187a7e", "comment": "Malware payload (Formbook)", "value": "af18be0c65aba5779cb7af95ab52906ad9e69a01c1c8eb48a2407bcd309066b1b2c66f0791202bceb2b48c896bb8902f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578687, "uuid": "e7c7f2da-a51f-4cc6-8c6d-c97262964f3a", "value": "T10705F0657380EF8ED23E4EB5D442D900DBE0E2739707F3C7ADE605EC598E6864A63246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578687, "uuid": "24a2e92d-a618-478b-a0f3-8be0a7cfff3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578687, "uuid": "f02dc32c-1b48-4a76-904f-63476bd564f7", "value": "24576:Q63f0MxtG+qZNSx9z03ETZlj3/NkMaE1yUv08ztH0HpoyI:yMXG+qX49751k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578687, "uuid": "38940dbd-330c-433e-a03a-bbd6874e210f", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578687, "uuid": "4f7f444b-2f33-4afb-9384-400f6b87c161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578687, "uuid": "f634efe4-b0b8-408e-83b3-0ddcbccb3898", "value": "New Purchase Order-210809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1b9619-fa08-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628620149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620149, "uuid": "5dced321-fbc1-4e44-ad6a-aa04ee9c4da2", "comment": "Malware payload", "value": "35262b4f3d7b7c0dea8066ffeac03c99", "object_relation": "md5", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620149, "uuid": "24062fda-0d52-45ac-a5b4-10b7c348364d", "comment": "Malware payload", "value": "2a0009f47d4f68c7812fab90522ec41db9fbf921fe3d239f92655412da07a975", "object_relation": "sha256", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620149, "uuid": "2813a1b1-4944-489c-a17e-7a70370ec7ae", "comment": "Malware payload", "value": "cdc4b26c859979fc8283c1888f36584086cfcb99", "object_relation": "sha1", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620149, "uuid": "1121e666-1033-4573-a441-bc01967ed132", "comment": "Malware payload", "value": "80ea7f543173f00841e21f00a6822fe6a0b68ab363078905a12d74f3aaaa781f881cec02b158f29b1d5acb3f2506393b", "object_relation": "sha3-384", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620149, "uuid": "f424f8e5-c5b7-4381-b77b-66b4d131439f", "value": "T1E1E5334C8B83CD49CB7F437280872653721426AC5BD5743E4BB14099A9FBAE49B7DCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620149, "uuid": "38b29c29-a3bf-45a9-8fc8-e2c83f4f4cb9", "value": "49152:tDxSR1g3LWoWJZUMOfoQUI8WSyh+0pHTO+FsNUaKLDmqxS3K4mWiDHUgpmNzVOPI:t7LWouZQ9UFWfbxZcKLDmI0KHfgNBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628620149, "uuid": "bdcc5e10-f361-4a2e-9627-6799d95949b3", "value": 3025264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628620149, "uuid": "7bf4d319-66ea-4506-8a23-2f27c7c11327", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620149, "uuid": "2422d2b0-402a-4e47-9f68-434ccb45b0b1", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b939b2a-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628583751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583751, "uuid": "27389140-e449-4f33-acf1-6bb8183e55fd", "comment": "Malware payload (Mirai)", "value": "198040de116fc8c278ed946511d58477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583751, "uuid": "b3c1ecf9-033e-4a04-ad1b-7d33dea86e61", "comment": "Malware payload (Mirai)", "value": "2a63eb520c2c115e42e8bbecbad1b2e89ee9ad49b2487a11af78656040c842b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583751, "uuid": "e65f4df9-6420-4a21-a969-be712a70fc58", "comment": "Malware payload (Mirai)", "value": "34062d46089bcd9b8e56dad7dedbe01f2ab907ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583751, "uuid": "e348bf1e-5ab9-425b-a9a1-9f38766a39ee", "comment": "Malware payload (Mirai)", "value": "95aa5344354b1faddbb1fa0a13575ffd57639cbf73f41b48868b305255b290d0331d22157cde1506a5178045b71a9076", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583751, "uuid": "de382780-38c9-4dc7-82dd-ae321ca2ce0a", "value": "T156735B4232680E47E5960AB4253F1BF093BFED5024F4BA88694FDB5A4A35E771186FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583751, "uuid": "16ece172-94e9-4b91-938e-0a7ee96399e9", "value": "1536:8Szq+RGHcCRLV68kFD+N+tHeDXtfeEVXqd0:ckGH7kF/+BeEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583751, "uuid": "f2d72143-a74a-4610-a0ae-06a59fb8578d", "value": 76236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583751, "uuid": "c7551023-4ef1-4197-9834-c0a210dea0ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583751, "uuid": "7afae7da-b961-4261-b1fa-1f91e7134f61", "value": "198040de116fc8c278ed946511d58477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb199b06-f9bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628588770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588770, "uuid": "e22e4f2f-0ae4-443b-b7df-5ab7a1af5a0f", "comment": "Malware payload (SnakeKeylogger)", "value": "9d8a33113e892c3b6e9bf6fa0bd54d98", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588770, "uuid": "2d5271e4-5bf2-4d5b-8533-ad8b3f7f7425", "comment": "Malware payload (SnakeKeylogger)", "value": "2ab81ddd9dd9c9ac1037d054db9a444547212bff5f46795eb0021f9cab4e9cf0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588770, "uuid": "598fb523-c959-4c0f-ada1-dc6e84d24a25", "comment": "Malware payload (SnakeKeylogger)", "value": "81f677df6083e41d1489c4a19e421177d1d91bc7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588770, "uuid": "d3978f1a-d2df-4faf-98da-8be3177afa13", "comment": "Malware payload (SnakeKeylogger)", "value": "3ebb09f20240fcdd942102155c4ec8c225100f88135c05b639208c9be88209982e4c2ba257fe6ab817bf4b49209833fe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588770, "uuid": "0cadfc28-e8fa-407d-8816-ce64ec265866", "value": "T15923FDACC4A705E88F89BBB85B2B6F45018C766DF7859533327C973427D2E3A501683D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588770, "uuid": "ad5f49ae-40f5-44e3-a853-b4d69e8e50db", "value": "384:xrl+NPkkKVHnp1gDe/hGnjkRaoz9bNrKwC:KkLX1Me/hBR5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628588770, "uuid": "32a62e45-9cc4-461c-807c-f44d0e2bb180", "value": 49644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628588770, "uuid": "22574c6c-99b8-473c-9b92-92caf55a6f9b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588770, "uuid": "bc86fba2-a2d6-4bdb-a778-18fbbaef3e36", "value": "BOQ10.08.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e03e32-f9e9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628606564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606564, "uuid": "befee10c-d7d0-4bb5-a210-a1a6854d34e9", "comment": "Malware payload (Loki)", "value": "30df8724718778ec0589b833c8a6c9c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606564, "uuid": "5b81a471-e2df-41c3-8e4a-9f346759f5f3", "comment": "Malware payload (Loki)", "value": "2ae1d4a010484f785fe45e1aca43bfd133e76f664ce85e3cd16d1518c8006013", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606564, "uuid": "6282d9bc-94e7-48f3-9b2d-5b564c01fab8", "comment": "Malware payload (Loki)", "value": "4eb7025fc71a2ef2f9e2b73ce28f9eb9b7f6f4a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606564, "uuid": "1170891b-80fc-4c52-8b60-54a635137e49", "comment": "Malware payload (Loki)", "value": "f4415a334dc91ec324a2d451ab0c13caee20cd248929f6f5efe9f66c3f89b58e9884dc5a89a9bad87a44c2bed5dbb30d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606564, "uuid": "3bbbdfbb-4a92-4fed-9abf-3c52dd36d60d", "value": "T1B1F4E0667790FF9EC13B0FB6D5015900DBE1E2B75307E3CB2DE209DC268E6994A63252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606564, "uuid": "42a4967e-2a5a-4c28-8bae-36b0b2c2762f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606564, "uuid": "1df05757-b8a3-4f0a-aee3-8ce0ed3726d7", "value": "12288:dwL9PjqLbOvH+HJYpQQ2uyaCBpvm+IPq56YGw/fTb0Vd5tSLKQrCgxBDoC4YK3:dwLpqPOvHWkQQ2uyaCHmPP9YGw/fTb0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606564, "uuid": "9c9284b8-d683-44a8-b17a-4b4b04f74fdd", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606564, "uuid": "92196db1-52a0-45cc-ad0f-119e3c28ccc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606564, "uuid": "a74f6134-2e18-4c19-9938-13d7106ca1ab", "value": "30df8724718778ec0589b833c8a6c9c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f09c762-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628576429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576429, "uuid": "b7e25799-3e87-4474-8a07-14095f100d42", "comment": "Malware payload (Formbook)", "value": "2cc50352cb33f5c8b4b4845044327562", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576429, "uuid": "724ac45d-8800-4742-b1ce-242af7e30d93", "comment": "Malware payload (Formbook)", "value": "2af9ffcb95eb7c365400be5b84601812703a24c99d4a598653fde25b8813e0fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576429, "uuid": "e22035d3-6d4e-41ec-9af5-179d9753dfc7", "comment": "Malware payload (Formbook)", "value": "68c002e6286ee485f50f4bbfb664d06a0f2b83dc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576429, "uuid": "9360e0b2-529e-494a-b9cf-6c9b5a69f2eb", "comment": "Malware payload (Formbook)", "value": "112749c652a59d3bccbe787e3545933ba7f37bea2c22cbe451785aea8a3934b17e0b5e63b6b7cc4862bd455eab0fa607", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576429, "uuid": "6d211b7c-8e67-4593-90c0-1540941d9bdf", "value": "T16743A36CC0AB05998F86ABBC272B9F45018CB56DF388A133367C9B7457C2E7A501397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576429, "uuid": "52c7100e-f2e4-4259-8997-4f51d962c4f7", "value": "384:6NGGRMXoJqFkxRnuyBzBaqN3g8180g9HY4a+gzUZ46Mq1X8QwOphNN5oy:6NGGRMfFMnFVdoBhFgzUfsgpX3oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576429, "uuid": "be2712ad-e6d6-428d-a277-bc731b125bcb", "value": 56882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576429, "uuid": "ee9c78e3-089b-4334-9642-176a916da8a9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576429, "uuid": "1a3b1d43-9640-4614-b237-817ddec54bf5", "value": "Order Inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da462a6-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628608800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608800, "uuid": "21b9ac03-4602-4db8-9165-0f17cdacf8be", "comment": "Malware payload (NanoCore)", "value": "20fc4905deec49b284490fdc03ecb1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608800, "uuid": "c6b413cf-25ed-436e-94b0-31a81ee1bc74", "comment": "Malware payload (NanoCore)", "value": "2b4aa9d2057b4b7e67bbc3f30911d4aad35f8af5e10d4c587b4254555bf4a695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608800, "uuid": "c5b7ca81-d199-4844-8825-b85942d1682c", "comment": "Malware payload (NanoCore)", "value": "fdedc862bc7ac7324f96ff00aeba75ef6f6b6967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608800, "uuid": "64a8b858-dd83-4cb6-b3fb-714daf313bb5", "comment": "Malware payload (NanoCore)", "value": "1d5a33d8c038347d7b7c0937b2d7c9264bb57c55acd58e94ec3f9476c64ca08271c58046f90609736c30296de71b10d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608800, "uuid": "0823f63c-a300-4fda-9990-61adc01bc00a", "value": "T15DE48B2B26883A53E7BA8EB52623E065F763DCD6FA10ED0BCA8331C515767011DD6C1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608800, "uuid": "7a0ef778-7b70-42fc-9eed-402da919feba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608800, "uuid": "0da369f6-5668-403a-afc8-0005cb8923ff", "value": "12288:lYp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXMeJXfXUyh8F:ke3rLDQVteqvxeojT0Ggp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608800, "uuid": "c506cbf6-d2c6-43fa-845c-ddbf284a519f", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608800, "uuid": "887f14bd-7ad9-4452-aa5d-a0609bf61003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608800, "uuid": "13f72b31-9673-47de-907f-aedc1668ded4", "value": "new purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a17b36-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586313, "uuid": "9bb048d1-8a8d-421c-ab16-c571ff2ea26c", "comment": "Malware payload", "value": "1cbc63c8b3c912d26ea339aea496ffec", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586313, "uuid": "25df232a-ff86-4336-bdc2-6545e0821126", "comment": "Malware payload", "value": "2b58d004e334bc4986154e6a8e258d8c68243e560d991442bb7093a37114699a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586313, "uuid": "707894b2-f8e3-4d8a-a988-60a377314ea4", "comment": "Malware payload", "value": "01c62df8823721d86cfbfb0233e410b90ca18a59", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586313, "uuid": "fe1040de-6b6e-43d3-a976-8ecbdeec357e", "comment": "Malware payload", "value": "5dae0f8c7ff608274f13a627554c5f29215533b4d2b200bff77cef195e0e53b0bbbcdbcea1cc704a68ca44d7de7ce100", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586313, "uuid": "14731ef7-49c9-4db8-be7f-45f38f0a28a7", "value": "T13A0412DF2DB92CBDDBB44D5D3ED2208354C078E8E77E9E81B417BA111BE51E40C2A296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586313, "uuid": "158517bd-58e5-423f-82f4-b77002267c46", "value": "3072:UJHHNb4TTqz0C/5DxR465vvGPWfqm5dJ5lEIEi2/cImSe/mhLyn2JvDTHJgE0uJP:UZ9z7JtOPWf35lEPikmBKhvDTHynuOmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586313, "uuid": "30159fbb-3125-4f1e-987b-a8731b2b6b8a", "value": 188092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586313, "uuid": "efc6dc8e-005f-4fa1-8d38-f344c258fbc5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586313, "uuid": "ee28e532-acd4-47ab-9089-9b9a584f22ba", "value": "NEW PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7888801-fa06-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619285, "uuid": "673c5e37-d68f-435a-820d-66ef18c66222", "comment": "Malware payload", "value": "953dd96c040107d9f2f530fdd016fdae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619285, "uuid": "16d9c416-e57c-4f5b-9fbe-86b455c210ef", "comment": "Malware payload", "value": "2b88445b22f246b0fa92c00163a8d35f2dfb416bbbd80cbdf99a28be7d775ae0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619285, "uuid": "65dce4b3-c4f8-45c7-89ee-c9d3463ab8a9", "comment": "Malware payload", "value": "af9401b6399744f98f1e9fa438553c51ef9068a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619285, "uuid": "e2d72aac-64ab-4269-b0f5-e92916a24d0b", "comment": "Malware payload", "value": "6ace92b0ad1113ecc3330eedefa92d53b9fa7814eefac428839a88f5ada63c17d715b25ff33761a3feb5a2349ccc7ccd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619285, "uuid": "54d50b8b-9117-4050-87b5-f6d7d2e24c5a", "value": "T16B451230BA90C031F5BB12F444B6637DB92C7EB0573450CBA2D666FA5A392E4AC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619285, "uuid": "f0a465ac-a8ee-405d-af92-4cbf7d047dc9", "value": "e3cf60b4d5be6f57956398dd6440990e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619285, "uuid": "7ee3ffe5-9be0-47a4-bc38-6e2c23f35b00", "value": "24576:WQoE+18Ba1A+DTyScWhfyJqiOATy07GnjWT7+n:3at1A+DGFWk8+y07s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619285, "uuid": "fb83eaf0-2586-4faa-976b-0f6d4a2bcbd7", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619285, "uuid": "b0ba40c9-4f04-48e6-91fc-8699f7d49dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619285, "uuid": "970b5de6-1928-4311-ae91-63eec9572ab1", "value": "953dd96c040107d9f2f530fdd016fdae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619b0034-fa04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618228, "uuid": "4e62a41e-318e-4868-a75a-33230966ae34", "comment": "Malware payload (Mirai)", "value": "6eeb4425e465904381a54fadb6034cff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618228, "uuid": "d874b6ba-764f-4a3e-b718-bc991c7e6698", "comment": "Malware payload (Mirai)", "value": "2bffb8e7a7b2c3e4488e03eb6abfca4e2559cc003347dd8c2f13d8e0b1164ddb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618228, "uuid": "2e721cdc-6d39-49c4-ad7e-be51704cc9ef", "comment": "Malware payload (Mirai)", "value": "c4ed5c94dd77bcf55707a82641cbc27b1772ebb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618228, "uuid": "8323b437-b198-44e9-9572-0f7626fddfb1", "comment": "Malware payload (Mirai)", "value": "0a5d20bfa5433bec819f305191ccc9d1ef9615a1f46dd232406895c7d7710f25b7c10a54def5d65afef2bc012ecb1603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618228, "uuid": "a6de1d5e-12f6-4d66-bbb1-adead55af803", "value": "T17773AF23C9740E14D21489B171A5DF358B63E216818B3FFA9169CB18E983EEDF159BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618228, "uuid": "c0b4b3f4-e224-4dcd-8422-d7eb763f7427", "value": "1536:iBmMyA7F67ulK6W88qJi1GNZC09/SLusKqX9JY5X5hj:Mbk2K6W8kGNZPqgX5hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618228, "uuid": "1ba1195d-66b9-4959-bf7b-1f68a01c0f85", "value": 75124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618228, "uuid": "e5ba4d0b-f4ad-464a-9207-41aed7051737", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618228, "uuid": "1aa00a5b-c260-4cac-9558-a95af779b2ec", "value": "6eeb4425e465904381a54fadb6034cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dec84a-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628608418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608418, "uuid": "869cbe13-5306-41db-abce-4b877cba8bec", "comment": "Malware payload (TrickBot)", "value": "8f8d4a2cb29fb9a0920110384d712929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608418, "uuid": "5d190f27-4b63-4810-8aa0-ecec44dfe473", "comment": "Malware payload (TrickBot)", "value": "2cadf2841f6e4103ce2db16e443c63b060bae86812bcc90d3d4e93f09e6f5425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608418, "uuid": "0dab90c8-c800-4942-9823-9f27868a4015", "comment": "Malware payload (TrickBot)", "value": "08ad26e2e8b059b1a0d9c0e296409b51c303333c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608418, "uuid": "49e8db49-6e28-4c2e-b039-8b5ebd74f215", "comment": "Malware payload (TrickBot)", "value": "2b5a7c274ad9579772116939229f33117a73b5832c011838a0e4617491c12ec467d1654be96afa71d394d5eac65f098c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608418, "uuid": "cf04022c-0d15-4564-b09a-c1b6949e7fba", "value": "T1F994E1313280E472F163107489AA8ABD5AEDBCB04B6015D777D42ABE0F747D1AB3925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608418, "uuid": "9b84d7dc-37a0-4416-8977-c1da25d02023", "value": "e0b50ac12e1dfba4d95affb2dd541de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608418, "uuid": "1f2cea9e-4d65-4f10-a754-6588105adf59", "value": "6144:zjrzNW0NujooVXF4YqzygIWertnNQrmBPHU6fGkY48Y9sO:000ooVXFl6yBnNQrIPNGkYLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608418, "uuid": "6da26976-0db0-4ea6-933d-b995e0de9f88", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608418, "uuid": "40648477-2006-4abf-85c5-613d177f9761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608418, "uuid": "5a12fca6-12e9-4d6e-bd21-d0d4dac1bda9", "value": "8f8d4a2cb29fb9a0920110384d712929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d148245d-f9df-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628602524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602524, "uuid": "f701b840-23fe-433f-9ab9-793de563a4e5", "comment": "Malware payload (NetWire)", "value": "3fa4c5e2ea9396669ec1ef184b27b556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602524, "uuid": "bf136473-b5da-41f6-953d-3cb1a2aa1717", "comment": "Malware payload (NetWire)", "value": "2de8a5af5343e51f6cff51d8a692a4672c3af1110d4470e4148e38609c4847d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602524, "uuid": "bc04b6a0-1c77-4c34-921d-d8689023a7b1", "comment": "Malware payload (NetWire)", "value": "77bca326c7d69bcfa02c2172e28ba4458754b7f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602524, "uuid": "856ca4fd-be74-4163-9b06-45746428de57", "comment": "Malware payload (NetWire)", "value": "24bdf4a09d2160f6a1744418a51023deb1e092707a0b5abf7d13a491106bba6a6ece2dab21a04f053501b295a068d32e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602524, "uuid": "4f2e41f9-ee59-4d29-a7c1-9f004b37508f", "value": "T10A159E56DE8E8A9ED1194DBA9732EC1241325DBA2505E3133EC135EDD83B3DA849FE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602524, "uuid": "cfec535d-f7fb-4c13-93aa-9e68986b35ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602524, "uuid": "d31b2de9-fbdf-4e0a-afab-6552639ee25e", "value": "12288:wVrVgm6pJlsw7IYLIDEOivY/XGcnzo4bSD+rrr9Awb6SYv0TFLHhvLVPPQipP5P:YJgmwld7IYd/eX1nzox6r+SYujgipd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628602524, "uuid": "617d8222-0a79-40b2-98fd-86e93259a2cd", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628602524, "uuid": "20f25fc0-a251-44d1-a576-4ac81eb491cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602524, "uuid": "785db05d-7564-4686-866b-51ebff262038", "value": "Quotation Specification.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94274e0f-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628608435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608435, "uuid": "1cf55b66-8374-4e5c-aaf1-dec074627582", "comment": "Malware payload (TrickBot)", "value": "6555139520e9a06a86c41cfe735880f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608435, "uuid": "0cedb1be-67ce-434c-bae9-87370750f1f6", "comment": "Malware payload (TrickBot)", "value": "2e0cc33c355bd9d3bd9ff8df2f48000396e39a49b4a04253f767058a7dc6be6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608435, "uuid": "33c08ff0-d636-4d3e-8545-06efa26da451", "comment": "Malware payload (TrickBot)", "value": "87a1a922303c7e931d2143b5ab1e859a13c917aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608435, "uuid": "8094a5b2-bfa1-405c-affc-0f7115e3cacb", "comment": "Malware payload (TrickBot)", "value": "27c09b17b4bb8039198ed290160ccf2d4e5747286525b0f214692602fbe738f3c97bee7dd58547ef0809ed42765dd588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608435, "uuid": "7d15c683-2e9c-4032-8e41-e37c46aa60a4", "value": "T10194E1313280E472F163107489AA8ABD5AEDBCB04B6015D777D42ABE0F747D1AB3925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608435, "uuid": "ce78356d-a5ed-4731-9cd5-d1e6a558c45d", "value": "e0b50ac12e1dfba4d95affb2dd541de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608435, "uuid": "77a0708d-6047-43a4-bd92-de2b752aa2bd", "value": "6144:zjrzNW0NujooVXFwYqzygIWertnNQrmBPHU6fGkY48Y9sO:000ooVXF96yBnNQrIPNGkYLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608435, "uuid": "61568fc0-151a-4569-ab77-d798cc259ac8", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608435, "uuid": "a5f75bce-f886-4aee-9b5a-d90fd14e42ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608435, "uuid": "0a37e174-258c-44d8-8573-56ada34de38a", "value": "6555139520e9a06a86c41cfe735880f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb925f2d-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628603803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603803, "uuid": "d04287f3-5a1d-49de-ae6b-daf11a84773c", "comment": "Malware payload (SnakeKeylogger)", "value": "2ec128417a195a19b3622d3816bcf2ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603803, "uuid": "b2c43790-9e39-4f8c-8b2c-061cd6fe3db7", "comment": "Malware payload (SnakeKeylogger)", "value": "2f884ea5e0db8834637e6a97e1a3835d6b205f084b482a15c618989d777a1231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603803, "uuid": "4e9c9bcd-e3a8-48ca-be96-d3cc6556cfef", "comment": "Malware payload (SnakeKeylogger)", "value": "185d43e563137813389a0a32fec5ee8ae8945188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603803, "uuid": "fb2c823a-261a-42fd-90e5-27d4652498fe", "comment": "Malware payload (SnakeKeylogger)", "value": "ef2c7f4dc441fa760da70c6ef083018e44aa1dd9f8dfaaca7ee35e2ff23f070fe0d5007dcf33a6f0ffc94c30b32c8968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603803, "uuid": "7b9e3d16-6b30-4502-88e4-f2918a8c4d02", "value": "T1D1F4E0267684BB8ED23B4E71C9425810DBE0E7776717F3C73DE205DC0A8E69A4B23256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603803, "uuid": "5aaa3826-279c-4470-bd68-f5b4b8e350bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603803, "uuid": "dd86b9d8-65ce-4533-8227-2d7b9879c031", "value": "12288:2m1ukqhmCQIFXZYqs9tFgMigaw3dKgXK19eI+qKOFDKrdJQpuFBIOLRtwq6tZEcx:2bzmC7bYDt7zdKgXo9LpPKxJQpuguwqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603803, "uuid": "95b3758e-8923-4e0a-87b4-28ec720d0f86", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603803, "uuid": "4877fd2f-f970-4863-8751-e911b8558536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603803, "uuid": "77afcc12-5bc1-48b5-81cc-742019b53a8d", "value": "2ec128417a195a19b3622d3816bcf2ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b5c32e-f9e5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628604862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604862, "uuid": "59195058-9579-41e2-aeef-a76706683738", "comment": "Malware payload (AgentTesla)", "value": "b4a0c8a394a0f845ccf2f05345d51fb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604862, "uuid": "b24f3a20-5c89-4718-81d5-b096743c9856", "comment": "Malware payload (AgentTesla)", "value": "306336af5c11c743cecd385f6be70701b9ef60f38854da1be91993e3c6f83ff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604862, "uuid": "04d4ade3-5597-491a-bbc0-a103c0bdcc96", "comment": "Malware payload (AgentTesla)", "value": "5a5bb3a545ff905e6a2b870510029821a83b8f4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604862, "uuid": "e7be9625-7c37-4dc4-bfee-59140e9b168c", "comment": "Malware payload (AgentTesla)", "value": "79615ba75ab74803968b3aa50d3bb947ef25df08315add7840a2982394761177500f1f358a2e135f02d7896e464c09c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604862, "uuid": "6d368267-101b-426f-8b59-08047c3a2342", "value": "T120F4E034621FA714DC3887FD1C19D15127FEE01E922DDA782FA890BC7CB2BB856E1651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604862, "uuid": "69139433-09fa-45ee-90ad-9794fd13f21b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604862, "uuid": "4a8aa4dc-2ee5-41a5-b2a1-957765476d84", "value": "12288:1rZJ4mbA/w7oA+i1yx27GofV5XH7vBe1syaUVKnp:1rZScqjxm9d5X81zahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628604862, "uuid": "ce7fcc79-56e0-4ddc-b14f-46e2cda38bc8", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628604862, "uuid": "6e5f37ce-7c47-4d49-9438-b429ceae8cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604862, "uuid": "f098bf93-8428-469a-a46b-871b5e1339a3", "value": "Transfer Receipt 199105516Z 2300238427 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78355dde-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561143, "uuid": "13b158db-2077-4469-82cd-cd3f1a5bc000", "comment": "Malware payload (Gafgyt)", "value": "e5fcc53374c71c85f15cd68727f77f70", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561143, "uuid": "d5e9121f-8819-433f-98b0-a10329da3c35", "comment": "Malware payload (Gafgyt)", "value": "31ea5125d3e0271d04265cacb19ac018a94349c16a95e8d46b1422a49d989ef7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561143, "uuid": "88885301-aeea-474b-abd9-61034f237875", "comment": "Malware payload (Gafgyt)", "value": "8106a2b7e3d06ede5e2ae925d052be70f963026d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561143, "uuid": "9018dac1-35ce-4a06-adab-ebbeb9dc6e47", "comment": "Malware payload (Gafgyt)", "value": "9087c49c2526b7d73fd59f27caac5da4eec9cf877c3df385649e0ef680af553796c95e978c6ddb4966eac7bc26731481", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561143, "uuid": "9bd91be5-621d-496d-8a44-3af86f1f924d", "value": "T1EE935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B73D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561143, "uuid": "86e9cf14-66ff-4eb6-a9fe-5c520563c0ea", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3iyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKSifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561143, "uuid": "f548f87c-a321-4ace-b7dd-dc7b3ae58efb", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561143, "uuid": "de373cc8-b412-4a80-8ad0-3c85cebdb635", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561143, "uuid": "94614d2f-fcb7-4b14-bff1-3884c957d984", "value": "e5fcc53374c71c85f15cd68727f77f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32694242-f9e5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628604835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604835, "uuid": "c0df29fb-efe0-4644-bd5b-363f8654fc04", "comment": "Malware payload", "value": "382ad5e2a4496c107a38b9f6e9d25a01", "object_relation": "md5", "Tag": [ { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604835, "uuid": "dfbbde33-dbc9-4c92-9c1e-197fef1ec72c", "comment": "Malware payload", "value": "3228d0c85b90aa9ec045f080a9ddbf1ea7125ed69cf841f93c57f5bcc0d5d30c", "object_relation": "sha256", "Tag": [ { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604835, "uuid": "3deaa864-e69d-4765-ae21-cb49cd3b744b", "comment": "Malware payload", "value": "7a1c38f137f54a8fcf57dcf8059bdd09a7daa792", "object_relation": "sha1", "Tag": [ { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604835, "uuid": "f711268c-f43a-4c4f-89ad-cb701dcc8929", "comment": "Malware payload", "value": "daf5fb506a9b9ade30c45a8b752a59e431b95221259ffd9a60be6697539162808b875df49b4209bc46d94574c3521999", "object_relation": "sha3-384", "Tag": [ { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604835, "uuid": "df172516-9fcc-44ab-895c-f11ad5162ce2", "value": "T158F2F1C8ED1F45EA76A7F820E8A0B0A0C27337E79CCE64782480D357B2955C7AC1760D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604835, "uuid": "8926441d-8920-4746-9aa3-e3f833716ea7", "value": "768:rMbz0izO3JWlJ13dnQVlHTWX1lLFCQWeRj8PsxQ9eBgCYJ/PKxi:rgz9GJexQrzAnhwPaBgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628604835, "uuid": "aacb8adf-26dc-495b-960b-e28f10f95dcf", "value": 35155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628604835, "uuid": "cb65e189-93d1-45c7-a3ed-d8c1f4f381c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604835, "uuid": "51b321a1-469e-43a1-858c-d29c74c6c1f0", "value": "6716881121738752.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b964bed-f9f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628610380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610380, "uuid": "fdb26672-a8e1-47ea-923c-3c0c008c69b4", "comment": "Malware payload (AsyncRAT)", "value": "06f75554213802ce8966b2d1e870a25b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610380, "uuid": "1f735187-a79a-4b3e-8a16-9eaa59179167", "comment": "Malware payload (AsyncRAT)", "value": "322a1de0d4e993c58144bea400a55016d6961a76de613894dda88f5789d9c61a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610380, "uuid": "b73cdbd7-a531-4860-8016-72b986e1ae14", "comment": "Malware payload (AsyncRAT)", "value": "a6ea44f2280b3b90696672746e955ea0021d157b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610380, "uuid": "d4d9ccce-71d9-47e3-b29e-db4245740023", "comment": "Malware payload (AsyncRAT)", "value": "f7b2e46f7ee3130e981fd262dc3ecec81673d7f8a363fd650a5371dabd809f7834b3e9c5d4e55956794ed194a0b48fae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610380, "uuid": "8a976a35-e6f1-4ac4-860d-d202cd5f01b0", "value": "T153234D003BF9812AF2BD0FB49DF252448679F6673507D64E2CC412DA5B23BC6DB425EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610380, "uuid": "8fb6bb36-0662-4b90-b1d7-80d2d1544363", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610380, "uuid": "2cf7ff54-b635-4b0e-a706-9eec22a4758d", "value": "768:x6tKW2VIifsg3Ag42MMHthDt2bvvOFdL8BLb21wahG3OY8vLfT1g+xMLlx:x61hgMbCdLMb21wuG+YkLfT1bxMLlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628610380, "uuid": "5f21f1cf-d361-4376-a0e8-f5e673871f51", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628610380, "uuid": "f16cfc4a-3b80-4edb-bf93-4c5e261dc3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610380, "uuid": "ba20edc9-707f-4664-8fd8-ac4ec594e9d8", "value": "06f75554213802ce8966b2d1e870a25b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e71076-f9d0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628595798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595798, "uuid": "4bb83cd0-9711-4134-842b-84fabf9e977c", "comment": "Malware payload (ArkeiStealer)", "value": "d307a9934a5fd7513c731373c5786579", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595798, "uuid": "b187c845-97e3-4146-b5e1-948bd0822bf4", "comment": "Malware payload (ArkeiStealer)", "value": "32635b6aa5bcbdd18166e5a9b9469104ccc57a19bfe72dc3e3caca761ebc311a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595798, "uuid": "f8d3e135-cfcf-4b03-af5a-b738c2ae5121", "comment": "Malware payload (ArkeiStealer)", "value": "93d2c4394281156fc6cb1982509d441fe71b5ec0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595798, "uuid": "4dffb7db-e9f8-4b09-a227-00fd5f209abe", "comment": "Malware payload (ArkeiStealer)", "value": "478ddd19ba659e0e26a1e9ec6f3618356cc55a85b821a30a64c47ef62c196bf16d3398ca66c84eb787f804ad232ceef3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595798, "uuid": "0c4c5258-f35e-4797-a5fc-a34879b0828c", "value": "T1DAE4F130A6A0C035F4F752F845B993B8782D7BB15B6451CF92E956EE07346E8AC3039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595798, "uuid": "70881ceb-4d80-4d1d-a3a9-68e6e5f1d84d", "value": "3808cf5755aac20ce0592be1a9bc0f0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595798, "uuid": "ca8c0d25-4309-48e6-942b-87eb8328c02b", "value": "12288:1IDf9akx0SNIQAb8vOOzZf9H70pKpf3klQzoIgWslIg5DIAkhq:y1ak4b8Guf9+GklQhgZlI6I9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628595798, "uuid": "4be79a28-fafc-42d4-b5fb-4ce67d7dfe7b", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628595798, "uuid": "e819093b-1bef-449c-b9d1-6c78c4d82bbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595798, "uuid": "2fd66c46-0001-4088-8363-cdaad7971fb6", "value": "SecuriteInfo.com.W32.Kryptik.ETY.genEldorado.9034.2888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83ff82c-f9d8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628599503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599503, "uuid": "78b4b3b2-0292-4b2a-9a90-7057d254e5d1", "comment": "Malware payload (AgentTesla)", "value": "bd52ea5e27b88429e718105afaa8fa97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599503, "uuid": "5a9918a0-9e98-43bf-adf7-3f81fb25ad05", "comment": "Malware payload (AgentTesla)", "value": "326ccce7c418652680f38f8121657eb4f72a12667b1b56e6c999e2bf6ee45564", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599503, "uuid": "15530c73-8366-488c-96d6-30eb5ac79324", "comment": "Malware payload (AgentTesla)", "value": "656cbc12f64df997ff77d008ad130e8abaee571e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599503, "uuid": "9aedacb8-d0e7-4a90-97dc-f9b5e2de9c05", "comment": "Malware payload (AgentTesla)", "value": "2f8310845c6f1814ed0af5df4b773e807e5f6feb013f148fd54d1aa75285103c841d00bbd3c38de5a8ccda41c8f86cc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599503, "uuid": "47d9e900-7ed7-482a-b867-551e64eca2a3", "value": "T18A8128B05A7E1CD5EE3A41B2E739FD0613C4B10E05CA1EC131DEE8A50B2A35D4C27A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599503, "uuid": "c54b5769-3b76-47d1-a261-c2168ad7221d", "value": "96:S+QOqfL9rR7K942nEyfnazktiQBohK+/5+:nQ9D9l7potNNSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599503, "uuid": "f41ce1e0-495f-4bf4-b0fb-de7cb70551ae", "value": 4097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599503, "uuid": "3505aefd-b703-4f54-be2e-dadac4aeaf6a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599503, "uuid": "6bb401ca-c7ea-4e86-8c2f-9c8cde3bbd87", "value": "payment.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cbd1ff-f9f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628611580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611580, "uuid": "ac4b309d-38a7-445a-9532-7a7ff6bee5ba", "comment": "Malware payload (AsyncRAT)", "value": "5b8f4ac518b63ad22760cccdce780111", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611580, "uuid": "2c889b56-e873-4235-a757-785c8cb0d82f", "comment": "Malware payload (AsyncRAT)", "value": "32e9232c14e3ddbe71f437caaca8f3ea699b81a7479590527d7ed8969b5a4a1a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611580, "uuid": "738085dd-6305-4b3c-9f7e-0bfafb8e60f8", "comment": "Malware payload (AsyncRAT)", "value": "9dbbaa605d00f2810047d03553468d68cae09627", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611580, "uuid": "ea0cca80-f8a6-4453-b84d-c95f01afd266", "comment": "Malware payload (AsyncRAT)", "value": "a67000c2a06bec0c5f91277b9dcda586d43744601a6dff5c13f9715ce7ff2b822dd4a07330db934b761806aff1032a85", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611580, "uuid": "08b91eb5-381d-4a3a-be15-25108e422b49", "value": "T1D3232C043BE88126F2BE5FB898F562454675F6673903DA8E1CC402DF5613BC1DA436FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611580, "uuid": "8484406d-dff1-4b38-8213-55689deb1c65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611580, "uuid": "e102b5f3-4dc2-45a4-a8fc-366b2b1f11f9", "value": "768:C6tKW2VIifsg3ACjeG6KLDiFdBTebkhvd/rduYmjOfxQ1Gg+xMLMx:C610j6TrqbwvRr5SOZKGbxMLMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611580, "uuid": "da047f9d-7a37-45a0-8b8a-022365e68de6", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611580, "uuid": "44f53267-9565-4a82-b52c-5f0dca2c549b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611580, "uuid": "6c7f688a-1e3b-4013-8422-3af64d44c74b", "value": "5b8f4ac518b63ad22760cccdce780111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701907a3-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628603220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603220, "uuid": "59ed79f8-e086-4fa7-8913-4c12fb5c0e31", "comment": "Malware payload (SnakeKeylogger)", "value": "656cbe89e8de44a171f8e0928dd54c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603220, "uuid": "b00a1991-cb2d-4770-a6f5-d48bf9c71bba", "comment": "Malware payload (SnakeKeylogger)", "value": "334573b5d45dae9447050cc038264568ae3309ee64904d11ebeffeba2027cc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603220, "uuid": "c0f14e62-b15d-4214-8efd-d4288d425e6b", "comment": "Malware payload (SnakeKeylogger)", "value": "e53a2c04acc169c30b9ab79555f2cd045dca36af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603220, "uuid": "385c60b5-3e6c-476a-91c1-ef9dc5e4f96e", "comment": "Malware payload (SnakeKeylogger)", "value": "53f12c6c01730ab4bf5182be32203f6a6b89d2cd2cee82d06b429d786c28b4d3e6fef0c77ba2d2e8d03ff8adb0bf3de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603220, "uuid": "5b7e082a-d658-47f3-a8ca-ee39daa00e68", "value": "T15105014723800393C416EB3B189963970674EED8DBE1EEE97886752E2DF6701CE16763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603220, "uuid": "937cd7df-eb8a-4146-9829-bc3dde7fe36e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603220, "uuid": "c2de95f9-81ce-4346-a111-93bf3ac53723", "value": "12288:J/LNKAn3qGaNHEyC9/oR9gy5FHK7zpPZj4RnF6t6u3zk/8uLJKrjuiBswO18q/or:JxKAPp9AR95ylPZystHuUFwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603220, "uuid": "f24c90d2-12a7-4f78-874e-88e906bdea7a", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603220, "uuid": "b828a097-0712-4135-9e36-b5c55d7ca9e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603220, "uuid": "65d741bd-5081-4e45-bfd3-8f9cb3e20bc4", "value": "656cbe89e8de44a171f8e0928dd54c82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4208a7-f9d8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628599432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599432, "uuid": "8a8bde40-e244-4a91-882e-92adaa19171d", "comment": "Malware payload (Formbook)", "value": "cf3a28df3cd2682651ced75c40b06155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599432, "uuid": "39543e82-9e24-4b55-9350-29724d797396", "comment": "Malware payload (Formbook)", "value": "3357b4a89dc623781355fe7a673329975777b2a5ce8a2051c538dcb7d4969c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599432, "uuid": "c297ef1c-2864-4104-9645-19d3db699a22", "comment": "Malware payload (Formbook)", "value": "df85d8f256b8fd779d660f633eca94a7ea6c3cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599432, "uuid": "7c9269a8-49f5-408e-8a24-1c87036fe060", "comment": "Malware payload (Formbook)", "value": "03d02a3a7eea69642f254e677d57fba6eb14d27b2bce3a9520f7f12f7b7c9be0440c73cd0183b331ca4c986e91853791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599432, "uuid": "878d547d-f453-4578-a982-781a10402d9a", "value": "T18D34F11DBE1EFA49F87084BC7810E17F05887731549F5A777BD53F26A9A1288AA32D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599432, "uuid": "44227986-72c9-45b6-ae4e-49ea99b61960", "value": "b89f3af6e8726c625cba8a18b46cbaf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599432, "uuid": "28eee1f6-824d-4224-88ee-1c7e20a4af25", "value": "6144:Na/djfLqZHNlXeQN/TezMUpyXVG71CRdzf:XfnNQpB8zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599432, "uuid": "29e8d41f-783a-4c85-80bf-b6606b8cbc29", "value": 251295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599432, "uuid": "71f4d349-4cf4-4691-a440-f935391e390c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599432, "uuid": "213fef5f-8135-49e6-bda6-3855c471bf88", "value": "VESSEL BOOKING DETAILS_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31798b15-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628585076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585076, "uuid": "798dcebe-b928-436b-916f-994ad41079eb", "comment": "Malware payload (AgentTesla)", "value": "6d00caa274181747e725ece6082b0ede", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585076, "uuid": "6e9cc1d5-4714-4c45-a45d-bcddf21a4dd1", "comment": "Malware payload (AgentTesla)", "value": "33c613ffbd3f55b7ab66e495cd5b327e856bcea49e3ab8d2537ea8d6efca70a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585076, "uuid": "ddd85be4-9bd1-4882-be2c-6a0de876511b", "comment": "Malware payload (AgentTesla)", "value": "97aab61645d01a5c617d2c6d0a242141fee2e552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585076, "uuid": "34c2a482-706c-425b-ba77-f8355b18f41f", "comment": "Malware payload (AgentTesla)", "value": "d866b6ebf1ffb1baa80d69e7730de220fb9ac7bbede15d19612504438c82d05da11ae764fe0ab4463cfda14c3363a8d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585076, "uuid": "4fc4e06c-7f96-47d4-9a3e-443e16f636ed", "value": "T13105E0667740FB8EC17A0E75D4426800DBE0E273A707F3CB6DE319D8558E6DA0A2B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585076, "uuid": "f5bd24a1-c37c-429e-899d-2013ca367467", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585076, "uuid": "10d46758-f86e-4659-8a9b-bd2c0f6fadc5", "value": "24576:bjaThvXUprT0gtSLF4H9P33eYzdbHs/CrvsRpkzPO:bihvXU98SP33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585076, "uuid": "231689c7-52e4-4a9f-84e7-ff25034cc2d3", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585076, "uuid": "2cce3fc7-2d05-45b8-a276-56447bd1b12d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585076, "uuid": "20cd60cd-acf8-4916-bfc2-4ace8f07b74b", "value": "6d00caa274181747e725ece6082b0ede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463f31f3-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556764, "uuid": "f0a05b83-a755-40c6-8389-2ded5de85871", "comment": "Malware payload (Gafgyt)", "value": "f6c5101610206b4787741c8b1e098aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556764, "uuid": "3c5e443b-1495-484d-8a00-087c5deb476d", "comment": "Malware payload (Gafgyt)", "value": "348d11bebfd799b275fab4e87bb4f8d70511c248b856707c4f969f35c19c93dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556764, "uuid": "c856bcfe-f81e-4fc1-bef7-2cc9e3fca249", "comment": "Malware payload (Gafgyt)", "value": "5a227708cf337c874583e47920ce868c85bf878c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556764, "uuid": "900e6e6f-b406-42f0-a43c-033d23004810", "comment": "Malware payload (Gafgyt)", "value": "98b3cb4e36bfc49807104278f86380693ac96a1fd65d50cead4a8b62ed03429a224b524005acd23759d2f28090d2b517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556764, "uuid": "10a71576-4393-40d2-ae8d-f451716c19c4", "value": "T1D892D1B5AEE05376C47CE67168060EDD0DE0B81BD1CA4F035D94EAC985901FFA578E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556764, "uuid": "6b0ba68a-7d02-483c-9244-f7c4a9aa4dc1", "value": "384:q/gUy5Z41SuynPbuIt70ZFdAynR982UU3UDfK/dq28ouCgwAV88uMMBcLiFqcJni:0Gpjuj9AynrIo78ogwAVvu9BqsRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556764, "uuid": "c56de78b-15ab-47fa-af5e-76f205484ecc", "value": 21152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556764, "uuid": "b5be5f9a-7c92-49b5-a8fb-696e3c45a2ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556764, "uuid": "da3f2643-4bab-46ed-8e4e-e8addc9381f8", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.30602.14161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cca24a2-f9da-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628600208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600208, "uuid": "543870e0-a0c4-46c0-8f7d-afe4fb5afb0b", "comment": "Malware payload (AgentTesla)", "value": "b3b1c133187501eff921f2077bb07d78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600208, "uuid": "6f216392-095e-440c-bf98-a7d780cd8603", "comment": "Malware payload (AgentTesla)", "value": "356de4efe4fac16315678d89d906b4e6ee7a7ff7c8bb4dacebaa4f0ef573211f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600208, "uuid": "e7c20c0a-485d-480e-9d45-8347eb56ac1a", "comment": "Malware payload (AgentTesla)", "value": "a57eb5230792b3a1efb0c71526942d58d1b4b080", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600208, "uuid": "7a099c83-7fe6-4dc1-9f61-202aa117cc71", "comment": "Malware payload (AgentTesla)", "value": "23cb7b7bfbf6a830584a0b866c6b35def551dc425be735d860aca97cbec2bdb2373af2106a216cd214b18f35bd00be4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600208, "uuid": "9ecd7d17-2898-404a-ab9c-2b09d0af08e9", "value": "T17E05F169B780BF8DC07A4E75C4025400DBE1E6776707F3CB2DE219DC5A8E69A8E23356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600208, "uuid": "7ecbc3a9-68e3-42f1-918a-db5c13c086b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600208, "uuid": "f77c46d8-74da-4695-8b0f-72fc403940c4", "value": "24576:jkZHU1FQigRoL0GfOcWxbdOCsAOxznpDZpSINKPKj:QZHU1FNXZmcyWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600208, "uuid": "737a0b89-8cba-4482-9573-acd058c1c128", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600208, "uuid": "6408a7a3-338e-4709-919e-565801bdf247", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600208, "uuid": "dc7f671d-b41d-473d-940f-cb206767f3d0", "value": "Rpjz1pyVGhjBUG4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e944b68-f9d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628599621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599621, "uuid": "71bcc960-d1a2-40c9-8fd8-dc24546d28bc", "comment": "Malware payload (RedLineStealer)", "value": "b51da338fc5e8c127c48bf3d9bcc9ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599621, "uuid": "5a4bae68-3001-4246-9301-80f7236d7b03", "comment": "Malware payload (RedLineStealer)", "value": "371827d3309f0b2bff933583e4b4ab2150c6e40c6396e66b3e029a1ec97c99de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599621, "uuid": "01d7c24b-fb0f-48dc-9160-16811f8b1185", "comment": "Malware payload (RedLineStealer)", "value": "4698c9c583278f3273749f2e55e3a3055e1a04ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599621, "uuid": "9c62bce5-5564-4192-83b3-a9d43490919e", "comment": "Malware payload (RedLineStealer)", "value": "5d256f4be7a12c81213da2be9b78afdf46b76b60f803727d08a7d7602961812cbebe2216b074a8d4a86aeb5dcdb00923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599621, "uuid": "b7ff69e8-fb1e-4da3-8f67-9c7441a30fc0", "value": "T1F894BE30ABA0C034F4B202F845AA93BCB92D7AB25B7451CF52D15AED57346E8EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599621, "uuid": "7e721bd6-8b16-42f4-a02e-4f60322f7f89", "value": "cc4caabe2c1a9c923331965c9764375d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599621, "uuid": "9b44ca91-5662-42a0-a767-393259d765c3", "value": "6144:C/E2vtp+xTTlV+ugB8TkMXakryKKCZ0qRuqlhysMUNeqan0EX7vVXT/LzQ:Cvtc9iugB81XXrySfhon0k9zQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599621, "uuid": "637eb4f7-91c4-4488-9a86-8d6d0e61106f", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599621, "uuid": "c59f5439-2ead-4a86-b01e-dacffd7ffd8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599621, "uuid": "c9b370e9-fd3b-4e49-b073-21830d8e998f", "value": "SecuriteInfo.com.Variant.Bulz.596078.12171.30029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd68880-f9e5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1628604827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604827, "uuid": "8ac98445-d5cb-4e8f-83e4-c3c369169522", "comment": "Malware payload (IcedID)", "value": "d49b451b6c66ab7b466a9f85e8477e63", "object_relation": "md5", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604827, "uuid": "ab90de98-6d23-47ec-a4bf-0f41456aeecc", "comment": "Malware payload (IcedID)", "value": "3751f2293918f941b2a2b996334c4ea2e1240085603f3a29eed55a7c7063089d", "object_relation": "sha256", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604827, "uuid": "ec2e9654-4d0a-4266-8710-4209b9143f48", "comment": "Malware payload (IcedID)", "value": "1aa1e0a42df6b985872a1c6dc0b0b4dce3041d94", "object_relation": "sha1", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604827, "uuid": "6acd29d7-74dd-4bd8-9acc-fc5af7ed2a1a", "comment": "Malware payload (IcedID)", "value": "30c7f61c82a1917d1c98c80211f6c5fa40d495a2c02d07509017b9d973cf855f662ff3718c281735c487223fddc10bb4", "object_relation": "sha3-384", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604827, "uuid": "b7a0ec11-f616-46d7-b55b-ae812c127646", "value": "T1D7043B068545D667FA218C78EEC1B7E9C0567B392EBCE7F33C66D46028345C24A5B2B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604827, "uuid": "56c4ff4f-90b0-4795-ab70-5e7b1a6844ca", "value": "3072:fOoxrLQlBh7Z7ATRMWieR2fLbOnCN/fkRzxS8qWGg7QzynjpOXEo4811soyQXoc7:fOAiRZmsRyvwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628604827, "uuid": "52ce19f8-8603-4f3f-b63a-4e97364f301f", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628604827, "uuid": "63c5b7af-c40f-4800-818d-5abc385bd80f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604827, "uuid": "591cb6d8-1a12-4404-b139-b83276e0a079", "value": "update_1628604308.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe5df3a-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1628601019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601019, "uuid": "130dd5cb-091b-4c7a-a03b-299958fdfbc7", "comment": "Malware payload (RevCodeRAT)", "value": "c0822708a2d2b1be0e853e96f1473f44", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601019, "uuid": "8dbc44b0-4381-4206-b5d3-d8f3ec201107", "comment": "Malware payload (RevCodeRAT)", "value": "381c0425a341144eabce9490808898b95dfeeadb09aa280116eb688b93f3abeb", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601019, "uuid": "7a0e77d1-98b5-47c8-84bd-dd50c8fd23aa", "comment": "Malware payload (RevCodeRAT)", "value": "eb299b3f06b4d1bda482fc98dad3fa740c8f0919", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601019, "uuid": "a94e31b8-a845-402c-a7af-300bb9186ddf", "comment": "Malware payload (RevCodeRAT)", "value": "fd5d7e592a7d93e959b2a7b3d360faf15bfe0042ac157102f4197cdb60806b795909de98aa5622f9e4561dc705d4439c", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601019, "uuid": "3c87753e-a44b-48fc-9e32-e369ed1e22a4", "value": "T17FF4335C9C8873CC30A4D010EACE67D69E834324B7ED90A76D9DCE51D8E61DF78A216E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601019, "uuid": "1115c153-f39c-4491-9438-c880634cd1e2", "value": "12288:DX7ER6qdlNwAunE4rd8PtAFnqIPbnokP8CJxSj18ScVwb9bTVxYoVVwqsEJn5znR:DX7Edw7nEwd8CxqIPLBJxSB8tVwZbTQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601019, "uuid": "5a3f2ea1-a557-40e9-aa77-360c9976206a", "value": 783591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601019, "uuid": "df38a09d-b630-40ee-aea8-6bdd5bd39104", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601019, "uuid": "65b035d6-401d-45c8-a48d-e5a61d7e96ae", "value": "STATEMENT OF ACCOUNT.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e632180-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603056, "uuid": "77f55b4b-95f4-4aa4-8907-6b7d08f36e88", "comment": "Malware payload (Formbook)", "value": "158d07c37f56412ce5f16891448e7b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603056, "uuid": "edbcdcd1-ddc4-4c70-a6f0-ae8a83766929", "comment": "Malware payload (Formbook)", "value": "385f5ca91b0a230a14f5d32c79d061a3af0f5533923ad62e1982d1327ed086a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603056, "uuid": "ee3dcddb-d255-4eef-aad4-7a86a9a919ce", "comment": "Malware payload (Formbook)", "value": "87df1f1b527f28875ca1590543ca51ae12797b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603056, "uuid": "9bc8bc7f-8949-420a-a545-61cb02583c32", "comment": "Malware payload (Formbook)", "value": "bd9d594df1ed795e2f0508159e516f64c6211bc487954f446b27d303db305c5d054fce507fc86458fe3d55a202c721d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603056, "uuid": "2dc09959-30c3-449f-9dae-efc4ce59b2ba", "value": "T15D15024B328096B3C4259B3B8C5DA39247B8FEE5DB61DDAA7882392D1CF37418E01757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603056, "uuid": "971cd977-f32e-4875-8a3b-d54bc598fb53", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603056, "uuid": "db921418-3780-4afd-a8fb-60a7340f0271", "value": "24576:kPp9AR95SkXpgex+Bp+MN7N2y90rgF1oeQo:kPpKRSk7xup+kN21gFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603056, "uuid": "6360d9be-b84b-441f-8d11-df7505ec5d45", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603056, "uuid": "655445bb-6486-4427-8b5f-c79dab0220ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603056, "uuid": "ea51c634-a989-46af-b539-119183974778", "value": "158d07c37f56412ce5f16891448e7b65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8628b506-f994-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628570186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570186, "uuid": "e407cc87-956e-464d-aa3f-b4c0a14f34bf", "comment": "Malware payload (NanoCore)", "value": "d75e198aabc8f95796bd8a8cd15a5313", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570186, "uuid": "9eb18181-1e22-4ce2-b223-106dd9725462", "comment": "Malware payload (NanoCore)", "value": "396af88f6a9eeb0614ce8aa23bbb42b24ce01ab5abb18b87d49a24dc16db0a7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570186, "uuid": "ba3c12f1-8b21-4c38-90c5-1c93ecd12305", "comment": "Malware payload (NanoCore)", "value": "52eda5c4c002aa5b9672275b276786e2a94e5423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570186, "uuid": "b3901ef2-25dc-4de8-9ab5-db28d83f8b08", "comment": "Malware payload (NanoCore)", "value": "8814f90ac55e4e399fcf53e708b1d3bf637d147e4e5748645643cfddf8a099778e54c5b5e428752114610117401c5057", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570186, "uuid": "de72b6e6-e6d5-4d5c-be6c-f149eafb0608", "value": "T119056AA9321075AFC95BCD76CA682C64EA20607A930BD303A45715ECDE0EADBDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570186, "uuid": "d7d5e6cd-4a68-4a2d-89b2-af53f815b788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570186, "uuid": "0eeeb24b-8eeb-449c-abf7-311b180e0db3", "value": "12288:5/2RuIocirEJUitAi6uwgP3VDbVcY6otf6Cjp5QuYhMKCBwurT1cegQXaw1yJCXA:5/2RIzr7BycY6SSCj3Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628570186, "uuid": "ec684778-fd4c-49e0-8b4b-28f8afd947b0", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628570186, "uuid": "302d24eb-5045-4c4d-aa64-5d91ecc9282e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570186, "uuid": "171749d0-75e5-4f4d-9aab-665f4b5e0eaa", "value": "d75e198aabc8f95796bd8a8cd15a5313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8cd880-f987-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1628564452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628564452, "uuid": "8f130fc0-3bfc-4eb0-9126-4a9b22a061e7", "comment": "Malware payload (Adware.FileTour)", "value": "7f3c9445e328d1aa858687584c6b1239", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628564452, "uuid": "cf5900e3-2446-4653-8f7b-118a09ce07bc", "comment": "Malware payload (Adware.FileTour)", "value": "39a9a517c08bed76dac8f15c60c0aa1f8cecc1c42a18f7fa1ce99bccc72abbe8", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628564452, "uuid": "de1ed988-7d6d-4dc4-af73-11cdf9fa57c6", "comment": "Malware payload (Adware.FileTour)", "value": "5bccb1da208b235e6c2076697154ad4e715ab205", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628564452, "uuid": "c7b31254-49e7-4aa2-a20f-c4dbe8831ffa", "comment": "Malware payload (Adware.FileTour)", "value": "bb25e508f7f910cf9094c58e9c20c128f8cdc389245aaca54725a5278aee4b02af0dab431d8c509fd3418cb1233d12d8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628564452, "uuid": "ee91267b-c1cc-440d-adfe-d66069cb9c5a", "value": "T1E7F53360B9E584BFDA50003489982BF784BDC59C0F200DA773B46A0DBF7ACA6D637657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628564452, "uuid": "50dc8c53-28ea-4fda-a355-f9c3855f923f", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628564452, "uuid": "b511bfeb-b4b4-4546-82db-07b20d77267a", "value": "98304:xkLl8fJz3VPEV6QMgUiBBB3Z1YQc8oCvLUBsKVV:xAlsz3VrFiBBlZ1YQcOLUCKVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628564452, "uuid": "471c7f10-5612-4f11-be3e-def64e3b145b", "value": 3349973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628564452, "uuid": "68fd897c-5e9c-4620-ac8c-86b5af806518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628564452, "uuid": "cf8bfe52-ec69-463f-a99f-d223a59c3758", "value": "39A9A517C08BED76DAC8F15C60C0AA1F8CECC1C42A18F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f4b77a-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603878, "uuid": "b2a590d0-89d9-4de3-80e3-98fd479b7306", "comment": "Malware payload (Formbook)", "value": "5542d74adaba644c63dfda933c161b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603878, "uuid": "3b6f523a-3617-4629-a1d7-16af94306ea8", "comment": "Malware payload (Formbook)", "value": "3ab397168d5f89738ccf197afe1e0fbe7abcc39a35f80d2b76ac349de486f121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603878, "uuid": "ea4fe5dc-f38b-488b-8db3-45da67f6e3da", "comment": "Malware payload (Formbook)", "value": "7d3f0f9050d3b6a9c12ee6f6911664803f755a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603878, "uuid": "a099f64c-bf6b-4b50-9e1b-fad6614c0923", "comment": "Malware payload (Formbook)", "value": "7c2644292ed5bd0c1ee72426ea970f881800c1ee8d2cfd4fbe4b0c40a04141308a2a02d6c119d67643876e4eb346b594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603878, "uuid": "270a4162-8043-443f-aa0e-ec8293f3ef4e", "value": "T17B54120D70444276F476F13B8FB721645A4D9FE04B252AE7DB94DA2EA834BF1B8310D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603878, "uuid": "bb4e52f8-cf4f-431c-8f3b-b51e86e14cc1", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603878, "uuid": "67c7500c-c6f7-4f19-a92e-aa2369317688", "value": "6144:JIOimmqT/NkUkAuz3h/KtdwRl8OxfhNCyY3bTqR7X:JIOiPqBVkAuzAEb8OJRYnUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603878, "uuid": "ff8d2fa3-c6c0-45c7-bfc6-68cbe84ec452", "value": 290919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603878, "uuid": "52fbc2a5-41dc-4f6b-a9e8-a64a37f5e8dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603878, "uuid": "8520425c-a591-4f03-8a73-f158c5cecb58", "value": "5542d74adaba644c63dfda933c161b93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12856b98-f9ec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628607788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607788, "uuid": "074c0068-c3ff-48d3-8e11-a0d421e21ed6", "comment": "Malware payload (Alien)", "value": "5e8fbf5138cb86522cfc8891f637af8b", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607788, "uuid": "d5adc612-c3f9-491e-a3c2-0d434b06161a", "comment": "Malware payload (Alien)", "value": "3b4d55a0aaf3ea759e6aaf5229b7b87bd870ee37863d10b1d2f286c742e0add0", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607788, "uuid": "441ebcb2-c96f-4d5c-a362-60b2a05cc921", "comment": "Malware payload (Alien)", "value": "749412b843bfd62210b8ef47e5ee4527c7d97abe", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607788, "uuid": "8deeaaa7-a9dc-45e8-9058-e7d5ebcbf5dc", "comment": "Malware payload (Alien)", "value": "f8cfc2c74ea02b41c404fa170266d9ff417b08339637cd309eb2da5af171c7ac9e2c9f7f3afc1543d319c998f0729d91", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628607788, "uuid": "123a4e76-5a4c-4ea0-83e3-f57b2a4368fe", "value": "T117E533AD5B43AC4EEB5B63F28103596BA937271C0D966E3F603412DA2853F64C311DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628607788, "uuid": "6f943517-b692-4315-9d44-d7a24c6e9003", "value": "49152:lbBRZhP56mpt9MADbnfK/tP6QJmV8WZ7HFmE670F9m/3ehYRDxoupSHNVEBQTHme:lvP56EWADbniw8D70avehWDxZpSHNVE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628607788, "uuid": "ccc4ccda-6af0-40b8-9813-2400c14a9cd0", "value": 3070916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628607788, "uuid": "22d1da85-4c54-46aa-81c5-f9e30a708630", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628607788, "uuid": "cfaeea5c-208e-42c0-8e4e-1452f4a4c0de", "value": "Porn_Tube.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3401e3b-f9f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628612003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612003, "uuid": "eca322d9-a3af-429f-a32b-a763b9e322f9", "comment": "Malware payload", "value": "6c3daf16b35fdfdd63cf8e229056ff05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612003, "uuid": "5f23c649-1e5a-4fe9-b33d-a9503aade93d", "comment": "Malware payload", "value": "3c17d6b6676bffb1a963784f757c163023961aa29364aeaa0f78d2790ed5b073", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612003, "uuid": "0abb7181-bb5f-42b7-a80d-e247df9e54ab", "comment": "Malware payload", "value": "2dfcd7cf46b1eaa6ff40b1528e662789b4e1c5da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628612003, "uuid": "bce10885-f0af-44f6-b972-33bfee6310ae", "comment": "Malware payload", "value": "dc2b57efc62daec1cf5bb5f7cc576170d669c499fbd58de628cef13aacb3d740aa67db3392f8c67f87de15f9c657b1c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612003, "uuid": "b5e16918-2762-4067-a5b1-653a17efbdad", "value": "T115F41202BA278062C6D44A72D8C36D3C0762EE537092E95728DD3F6934333EA7ED665D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612003, "uuid": "ce717a51-b581-4934-9526-8a6ebba161dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612003, "uuid": "7bce765e-1365-4b52-8eb8-903dea9aa7f0", "value": "12288:p5b9bhm2xC/Gfl5+cuIfmnCy0oAU2Mij/2CoIDIaNylGAE0eyvU1:z9btxCy+n4o5+juL03DAxez1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628612003, "uuid": "c7142cc6-9b68-409e-bca6-87fe75d34c86", "value": 741360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628612003, "uuid": "c6696513-b3e0-42e1-ba1a-1cc59d410ce9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628612003, "uuid": "10b496a7-2897-4a83-b818-0247da7bac64", "value": "6c3daf16b35fdfdd63cf8e229056ff05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0e6dc9-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628578544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578544, "uuid": "8b5e477b-5cef-426a-8bbd-11e081a3ff77", "comment": "Malware payload", "value": "43b82f36321ca0cf908212909e70e19f", "object_relation": "md5", "Tag": [ { "name": "jnlp", "colour": "#7AB74B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578544, "uuid": "a8eacdf6-ea01-47d0-8908-9a9fbae95225", "comment": "Malware payload", "value": "3c3774babf153fd8eb60a28a414dc25f70f145c949920b5ddb641662f3f75078", "object_relation": "sha256", "Tag": [ { "name": "jnlp", "colour": "#7AB74B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578544, "uuid": "a06d2a74-84d7-4c78-8350-77a2b514fefe", "comment": "Malware payload", "value": "45ec3d7183b5d6d11f36101cc9d5a1bb05e06227", "object_relation": "sha1", "Tag": [ { "name": "jnlp", "colour": "#7AB74B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578544, "uuid": "c19a62dd-2ed1-4056-b405-25415556c81a", "comment": "Malware payload", "value": "428fa759ccbd4e3e0ab79d5a460ecfab052a539493ca8464573f80e3c2df042f463d7ae81020f6aa426bdff7462e3a1a", "object_relation": "sha3-384", "Tag": [ { "name": "jnlp", "colour": "#7AB74B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578544, "uuid": "37a27d85-3085-42c2-80dc-53bafd3a698f", "value": "T1D4F08183A8C4B0BA960613465A71808DEF70268BB1F0055DB9EF10D20F113DEA6532E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578544, "uuid": "3edfa306-268f-4de5-b0a3-53c4670334e3", "value": "12:TMHdIBKZKddrC4cCrlxLyodSh8nA/umdp22AK2oB:2dozC4cCrrOzYA/umOK2oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578544, "uuid": "587f1a3f-df17-4224-99bb-c07338478a4d", "value": 619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578544, "uuid": "bc2ec21b-7da2-48d6-b337-d2b8702e302e", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578544, "uuid": "2b6c304a-bb88-4e53-83ad-8b6fa4bffe6a", "value": "CoinbaseSecureAccess.jnlp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f4114b-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628581559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581559, "uuid": "5e0bf310-38c2-4cf9-bd9c-ca44524a3b2d", "comment": "Malware payload (Mirai)", "value": "f4049665cb86d3d9114a5b5649f1fcbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581559, "uuid": "420a594f-4feb-4dcc-8275-f1cc9f63d7eb", "comment": "Malware payload (Mirai)", "value": "3ca787063519b9903be0a6893d22f341c8e6d3f0d951309e22889bee9ba41cec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581559, "uuid": "b7f82d9d-8fbc-464d-87f7-9b7dfb035e2c", "comment": "Malware payload (Mirai)", "value": "8fc152cae20bbdae6b70eaf74fd874174920f510", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581559, "uuid": "85497706-305b-40a1-8ef3-c134bac800f4", "comment": "Malware payload (Mirai)", "value": "2291dda387eb738c20a1aced35dd1e0cd810dd5cbb20a557a508535f0dabd34c4731cf65bde4cde9fd29d61411ed52d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581559, "uuid": "7fdf68f1-c62f-49d5-9f0f-4c19ecc92d6b", "value": "T185636C41B70C0947E2672EF43A3F17E0D3AFAAD021F4E545294EAB858171E32658BEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581559, "uuid": "69a22bf1-7e64-45dd-bfe3-29f7520c8177", "value": "1536:oKyPvg0c9TzH0DSo9ThYz217qUT0uj6CRe0FYK:oxyxzUpThjBZ3QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581559, "uuid": "0bb12e2c-15ce-4bcb-ab67-2ed6958970d2", "value": 71112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581559, "uuid": "7d42fd52-dea2-45b4-a9a6-b0487a73f9d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581559, "uuid": "ba3a90eb-c319-4b47-9450-04f12658f68b", "value": "SecuriteInfo.com.ELF.Mirai-QPTrj.1325.2228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7bc169-f9f9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628613494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613494, "uuid": "85e01b4c-4651-4c5d-ab3e-539447709162", "comment": "Malware payload", "value": "28262e1a96080650dec8256ab64148dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613494, "uuid": "c5d155f4-5ea9-4b84-aa3d-aee7526966b7", "comment": "Malware payload", "value": "3eb2cb23d9aa44b1587b2bee60549a56fee805655eaafaefe09dc651fa6d2ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613494, "uuid": "c98bb17f-6923-4c18-849f-e6250676a085", "comment": "Malware payload", "value": "69846595e644115cc919efa3216ea95c229db930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613494, "uuid": "64ecfc39-bf1c-4bed-aeac-5d305014da03", "comment": "Malware payload", "value": "e3296c8a535402e058f8697f13eeb41415cb387c980c4646792c925a985fb200a53727e203922de4fd18ac218f9f5090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613494, "uuid": "4862d4cd-fbf0-4f93-94cf-21338450cc90", "value": "T176E208067BE94215D6BC1AFC8CB313214772E3438532EB6F9CDC98CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613494, "uuid": "c6cdde4b-13c9-4146-8923-ff2803722c1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613494, "uuid": "9bb8d5e9-14dc-449e-ae60-dc219472b352", "value": "384:J0bUe5XB4e0XGORww0Q0mS03AWTxtTUFQqzFrhObbN:yT9BuVH55dyGbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628613494, "uuid": "a14a7188-69a1-4449-b49c-d7a49826be28", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628613494, "uuid": "680d5dd3-0e0b-451a-a987-a2d20da0a667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613494, "uuid": "b38a3f97-df29-46ad-ab3b-49d9755dfba7", "value": "aloosh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3807f57-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628560813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560813, "uuid": "1481418e-0762-4153-b82f-f2fc4428f22e", "comment": "Malware payload (Mirai)", "value": "b9adad272b409b25278bfbfc4bcbb685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560813, "uuid": "8ecc8fb9-10b4-4115-a6bf-7381970650f4", "comment": "Malware payload (Mirai)", "value": "3fbe7991c794da21c945f99342e2a5aab809fabd773aa959daaa47e0f7944782", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560813, "uuid": "0d2b1add-550c-41b7-8706-2a992ed5425c", "comment": "Malware payload (Mirai)", "value": "22e9e8a66f50ac1af3da8ef214fcdece55be4231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560813, "uuid": "c6e11afc-cc1b-4268-be09-650140bbd94e", "comment": "Malware payload (Mirai)", "value": "b66de5509728aa981a3749eb315d9b9b7c754f1d8172b3d070639209b624aff0e99d4ce58a9e2ccc67d74c46e7732a58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560813, "uuid": "0da29fad-a766-48b9-801a-08a3aeef1697", "value": "T182535A21BDBA2A27C0D0A57A61FB8765B5F503CE26A4CA1E3D720F4EFF215401603AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560813, "uuid": "6b879c80-d991-4bd3-9922-d3d717040b72", "value": "768:QroKQQs8sVWgdDZweJ6ls0m7hCG+0irtLeA/pFpcVqO+A7gnCgN:QrcQnsVWgdDZwm4FC/+0i4dV4ANe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560813, "uuid": "251fb130-4530-4bcd-8443-2b9991f52f21", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560813, "uuid": "d83d00f2-2b6f-4872-939b-b51256ad9711", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560813, "uuid": "fe2f4eaf-628b-4f50-b7c4-574fa47d1fab", "value": "b9adad272b409b25278bfbfc4bcbb685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732abbe3-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628583469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583469, "uuid": "e9004fc5-53ed-4d2b-a1fb-c856b1e73ca8", "comment": "Malware payload (Loki)", "value": "c700731279dc3294e76a17a6f0269044", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583469, "uuid": "c1908077-1885-45fa-99f6-f6da99091c4d", "comment": "Malware payload (Loki)", "value": "4009f28116301020e1400a3840fd19700e544322564d62b03101c8b01c0bc8a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583469, "uuid": "29c1d436-b834-4705-8808-510dfeef98f9", "comment": "Malware payload (Loki)", "value": "354388e78fd21b7858772121ed7e24b6ac83b426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583469, "uuid": "6558ae8f-79fe-4932-9362-13ffd85de2d9", "comment": "Malware payload (Loki)", "value": "e6efc06be850f7693ec93ac00bb48b27a83b7781988282465060b93209050c3a53a3c164dc503d4993ef7e5382993551", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583469, "uuid": "e3c12f44-1fd1-4c3b-a9be-f64930f677e0", "value": "T182F4E0AA7680BF8EC13E4EB5D5415900DBE1E6735707E3CB2EE719DC258A2D60723362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583469, "uuid": "e81a4a41-87a3-43bd-9358-1596e09eee05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583469, "uuid": "73f51f5f-ab40-40d4-a6a5-bc200167d568", "value": "12288:hxgoFXSGcQGLID4zqnYN0rM+BMDyWWQFQTt9ZwGOzO1q3swiuj0v9Ggmn8zrqcDt:XhSGcQGLS0mY+M+BMxFQTt28J91v9GF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583469, "uuid": "467683d6-225e-42dc-b352-d7f928f48d0b", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583469, "uuid": "8a4ae805-f82a-4bf7-8937-2309e90b36d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583469, "uuid": "429488b4-f8ad-4927-8251-88302df5c02a", "value": "c700731279dc3294e76a17a6f0269044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7edf95-f9a1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628575565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575565, "uuid": "f8f1894e-bf45-4e59-a97d-df90cb772aff", "comment": "Malware payload (DanaBot)", "value": "78e1100d5a478ba8bb78ae8b2711a268", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575565, "uuid": "0adcbbca-7385-4c63-9dae-8393b570ec2b", "comment": "Malware payload (DanaBot)", "value": "40b64bbdb68d008b482daf0459702e6f9f81603a65ca47db258714e445106c9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575565, "uuid": "35a38ace-17c5-44f6-96a5-a3fa33c7da45", "comment": "Malware payload (DanaBot)", "value": "ed9b70d87b55d98b08c56cbce7a83174eac1324b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575565, "uuid": "dfce9ee6-de59-48c9-af24-e2da75021ddd", "comment": "Malware payload (DanaBot)", "value": "81e887dc5ec6d85a91458dd40a38cf96c95f0daccfbdd4ff30176b3865d47215e22c00b91b44b1e7a91952c8ab160ce4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575565, "uuid": "b745d830-4d7f-44fb-90f7-b0c41269e23b", "value": "T1CB451230AA90C035E5F712F855AA87BCA92D3EF0573441CF46D91AE91B34AE9ED30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575565, "uuid": "824ae5a1-bd29-4160-ac0a-b25b6302ba66", "value": "10d590d1f4ed2f9a6fb903cd9f148a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575565, "uuid": "d442605e-2eee-4188-8c19-1dced35dd05d", "value": "24576:rQ5cNVldcfXb3xVmgLRkeAF2UMuxykg99iFKm6ZxGE/:tN3qtTLOhA9jkgGKm6/GE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628575565, "uuid": "b2ed1018-7c08-41c2-800f-26478ae34690", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628575565, "uuid": "a72424ff-d805-46e0-a054-b44d3dd82c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575565, "uuid": "3fc49a4e-f04e-4fad-a2d3-240db0929b57", "value": "78e1100d5a478ba8bb78ae8b2711a268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c639d8e-f9cf-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628595376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595376, "uuid": "4011a90f-a314-415d-b04a-96da01cbaff9", "comment": "Malware payload", "value": "d9bb807475089d7495c9d5712bd9d701", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595376, "uuid": "9dcc839f-25ad-4702-8851-7e7eb0a54ba3", "comment": "Malware payload", "value": "41fe3f00d43cb61d67cd1891001c65e2fd0493f39a6527c9535e1e2d7daac7e4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595376, "uuid": "141f6947-c8a0-4421-816c-1c44e9042db5", "comment": "Malware payload", "value": "747d8f3853e73f4916cf01e68fff1e682908a4a4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595376, "uuid": "57729bff-6fc1-448b-acb5-567737453c9c", "comment": "Malware payload", "value": "a245e292e6abf198a766d81f2a625ab99abd2965f1ab9a7bce923b4a67c89732626811cf33a309f7ccef670b7847537c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595376, "uuid": "7b3cdf00-c104-444d-805b-e5bc6c9c0cc6", "value": "T10665D081F3C9BC2FCDB7C4324B760A6B95868D5A8A46D7434561B12C8DFB9C09E85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595376, "uuid": "50a8ddc3-dc5a-4523-912d-85c57b5ffbd0", "value": "24576:p3vatmpDylmk2dYCsALaRJnXePOGoLFN6wG/+Ci22Ixggk3q6e3:p/atFld2552RYHcqw+U22xgkTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628595376, "uuid": "2fe20144-10c6-48c2-8964-465c141e308d", "value": 1514724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628595376, "uuid": "9cb50395-c7c4-4716-8a6f-73ecb2750143", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595376, "uuid": "9cff5a47-0606-4c0b-84a2-c833a699b7b2", "value": "goldmoonV1.3.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e181e6-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561136, "uuid": "c1fd8ac5-2e10-4448-92ca-89db862fcec8", "comment": "Malware payload (Gafgyt)", "value": "78d54240117e01fc1b6db7be98a8c2fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561136, "uuid": "b75b56b1-fcef-4b55-ad06-66cee437799b", "comment": "Malware payload (Gafgyt)", "value": "425010f8227161ae0d6777705a98f0cdb38d7f7b7cc8961984e6a4e468481de0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561136, "uuid": "78072a8b-32fb-4446-9977-7337244bbd4d", "comment": "Malware payload (Gafgyt)", "value": "4af8a841917b6ce83ca727800fe203d28f999bd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561136, "uuid": "756cdb77-9a3e-4cb3-9cb0-0caeb48a54b1", "comment": "Malware payload (Gafgyt)", "value": "c814d5a3c2f712dd8893e026a7fde27e29a54e2997a77d5a94e7df47e58fdeb3660999ba6ab73c038ef3248e32f02146", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561136, "uuid": "c4a4607d-edd7-4922-b633-4c013e72dc3b", "value": "T1A2833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561136, "uuid": "036a79a4-9b95-4ff8-90d9-6f99aa146780", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC0dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JDBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561136, "uuid": "866b502a-a987-4c9c-8625-852131b17a24", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561136, "uuid": "0591b0f6-ef2d-4081-ad3d-530d3b323264", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561136, "uuid": "7e0cf80c-e8e1-4102-8913-d915281366e1", "value": "78d54240117e01fc1b6db7be98a8c2fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f464cdc-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628608802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608802, "uuid": "98830480-e5ed-4c4b-afa6-c75e41ea4087", "comment": "Malware payload", "value": "1fdbfffa928c62b7ff6c756db08232c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608802, "uuid": "d6e0e6a2-f664-4ec6-b11a-407ac04e8993", "comment": "Malware payload", "value": "42f472d3fb4549ebb98d69aa807722cbffa7b8efd8314686499a44ee2e3068ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608802, "uuid": "b611e5fe-0cef-4091-8a25-8daf962505f4", "comment": "Malware payload", "value": "72d0a5d5b59c65f2eeef163887d53b1bdf614e1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608802, "uuid": "7733ffd4-f75e-4dad-9dc7-48656f0d1d17", "comment": "Malware payload", "value": "0c94182fd5f243626beb3f24ffd8edb92c551abfcb67d5eef558cf33f0f33675a4ae9e4198926baee832a696bcce17b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608802, "uuid": "ad8f69ef-4d50-49d2-9ccf-3b7aab35a224", "value": "T19945ECFCF5950F67934272198AC8586D7672DB32F1D5DF201228A34AC18EC2B87D9ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608802, "uuid": "1f3945b5-62d4-4197-9501-017395b41ae9", "value": "768:6NN2gIGsdZU+/awXYBtTYhxh82htqm2rJO/rCXHfWGh:AILBUbTYhbAvNO/Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608802, "uuid": "3eed2fea-ccda-4d27-86cc-9260801a36f7", "value": 1204792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608802, "uuid": "b8855a5f-79d7-4913-972f-e815fe5fe88a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608802, "uuid": "5079c6e5-42db-4d8d-96ec-588d8efa2ec9", "value": "ORDER-218105 docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e87b2d-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1628583955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583955, "uuid": "03ffc41e-d8c5-40e5-adae-e8666555e2f5", "comment": "Malware payload (OskiStealer)", "value": "5f0969cdd00801051ff7f2afd2343ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583955, "uuid": "6646bbf8-2967-470c-8fbf-d3913ee80efc", "comment": "Malware payload (OskiStealer)", "value": "43460a1724b2521dd5e97c68c16edfce9caf22d49452efd956a64db91b5935a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583955, "uuid": "a413c21a-d8d7-460c-b612-fa318159a30f", "comment": "Malware payload (OskiStealer)", "value": "6bbf42e0b05b025e8162404435eb1b25cc07d5f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583955, "uuid": "40329bc2-8c62-450c-89b0-344d3b5c6af3", "comment": "Malware payload (OskiStealer)", "value": "06016d1e47560a9d1c5dc3aba07558e590848c15918aa5d3b4011f0f6dd4c8a7f2057ce7e759a4b030da8f9a22f3849d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583955, "uuid": "270d81bf-7ace-4630-b3b0-127bbcdfa4dd", "value": "T11005E1657780BB8FC13F4EB5C8515910DBE1E2776307E3CB2DE285DC1A8D6928B23266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583955, "uuid": "a3db0f2e-df00-42a8-8ee2-e8ae35f553bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583955, "uuid": "28e0f697-902c-4124-939d-4bf29abb11f0", "value": "24576:seV+CQ38aT1m7NKsDTxe1/6hTMLevYWhzDcUjMFA:DV+CQ33T1m70sDTkhYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583955, "uuid": "46cf31b1-2f48-4505-9f17-83d55a8b6009", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583955, "uuid": "a440b5d6-8e85-4790-a976-47b81a88a11f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583955, "uuid": "09a97925-785a-44e9-b276-9d8a6801c4a2", "value": "5f0969cdd00801051ff7f2afd2343ff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8437b506-f9e8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (HawkEye)", "timestamp": 1628606261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606261, "uuid": "372f61e6-72af-4917-a21c-ffdd4f6e350e", "comment": "Malware payload (HawkEye)", "value": "83f58ecf0778e3b0acca8497df23ef23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606261, "uuid": "8a548264-e383-4246-8436-cebbdda9e07f", "comment": "Malware payload (HawkEye)", "value": "437fae5aa2cad8ddb1fe3e316afdc6a1fdd2676084131fdc082ffdc8a53f066d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606261, "uuid": "88e7a402-942e-44ef-bff9-db27451fee6c", "comment": "Malware payload (HawkEye)", "value": "a2123e816fcd387873272e022220fbc05b96d392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606261, "uuid": "7d0b86b3-8945-48ee-92c2-0b707b9e1063", "comment": "Malware payload (HawkEye)", "value": "efec9de9f15d74bd37120e25d38c2da1bf5124cae03546d86211e6dfddfb9178620a433d250b0ee52ad0f6a9c7ad6e44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606261, "uuid": "f18a98e2-bc52-4bf9-996d-953adfab2812", "value": "T13645F12F77CA62A6C5980F76C666165842F0C23B7176F7FB28C46AF0AD01756962F033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606261, "uuid": "c4ee706d-8a00-40f6-bde2-dfad407e2e57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606261, "uuid": "a203b0bb-1436-400a-8d5c-6acfd78376e0", "value": "24576:yVwq/EUmGq/wKgDyT/vcKcPw+U6kulaoS18PNMnDbMZ:yVw8lq/wK4wcKcPrXIIN6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606261, "uuid": "ee7b2f6b-fc25-4583-ba8f-9046675e2579", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606261, "uuid": "d32a84c3-7571-41bd-abed-11ba615d0d43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606261, "uuid": "d117403a-d93d-4d5f-963d-6eb19ac0a7d0", "value": "83f58ecf0778e3b0acca8497df23ef23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d92e194-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1628608397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608397, "uuid": "ffb963b1-fb9b-48f5-910d-1b2476a363bc", "comment": "Malware payload (IcedID)", "value": "12eb065c1e6a84842543f25e2d6a1d33", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608397, "uuid": "e78ef72c-8432-44a4-961a-1165fd382de9", "comment": "Malware payload (IcedID)", "value": "43a6a73b76e865ce40f8d61ffd2e961990122c190d7a76af334ddf1182f78137", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608397, "uuid": "4dfcc69f-8f9a-4c3a-9178-9dc0b88d2463", "comment": "Malware payload (IcedID)", "value": "e15391edfa62e45e9201c2cce4d57e88041c0c3d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608397, "uuid": "cc50e168-2a35-46f0-a512-5343994cdf45", "comment": "Malware payload (IcedID)", "value": "556acbaa59b973d1d4d18e880925780f2738783cea40ae648de5c623e642777668e9cbf3b8700b4905928aac9d76946c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608397, "uuid": "089ebe33-6235-4e58-ae72-7e044ae2d65c", "value": "T10103F844B291C617F26156798DD7CBEB3339BC0AAE01832B33947F0EBC796748A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608397, "uuid": "b41e613a-4e45-466b-a76b-a5e7ffa52eb7", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZOp:GJKCBcEVA8pt/AB6MI2Ur/lVOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608397, "uuid": "edb87f62-a367-4e31-b3f5-2a17e7b71ef3", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608397, "uuid": "f1c52fdb-404c-4d15-ac7d-3ce23fa932f6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608397, "uuid": "9648e98c-9ed9-4d16-a281-389058992050", "value": "12eb065c1e6a84842543f25e2d6a1d33.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc4605e-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586493, "uuid": "5c9487b6-7e40-4bd3-8da6-457ca89e3765", "comment": "Malware payload", "value": "a321fc35e653acb1c7308584adb519cc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586493, "uuid": "f51a2860-be5e-4287-a873-d2fe26cad680", "comment": "Malware payload", "value": "444debbf2d8eb1d65306557e29c705478bd59fd503ad7ade5f2a846e76a4d3ef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586493, "uuid": "05108b1f-e0ac-40bf-86d7-198fb83a5146", "comment": "Malware payload", "value": "cbc92cc7526a564cf97399ff332ec2cdb14d2940", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586493, "uuid": "309d4496-698f-44f5-aade-e0c3b9a0a305", "comment": "Malware payload", "value": "0d1c76e3b9442446b03c8ffa69f9a972db2aa229773a7c8abda9388c020f947b44c32a0e584d3c540399f39ce1452ec9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586493, "uuid": "92147649-ebc5-4ea9-a956-915986986b7d", "value": "T14D0412DF2DB92CBDDBB44D5D3ED2208354C078E8E77E9E91B417BA111BE11E40C2A296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586493, "uuid": "83e48ead-f959-45e1-9775-84765f0476fc", "value": "3072:oJHHNb4TTqz0C/5DxR465vvGPWfqm5dJ5lEIEi2/cImSe/mhLyn2JvDTHJgE0uJ3:oZ9z7JtOPWf35lEPikmBKhvDTHynuOmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586493, "uuid": "0ea58276-9b6b-4f10-9267-162a21f098ea", "value": 188090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586493, "uuid": "aa7c2a9a-36ae-469b-bf4c-3845883ef42c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586493, "uuid": "5e173aca-172e-42e2-a22e-ee9c62f46611", "value": "Payment proof.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8991b7f8-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628603693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603693, "uuid": "2bf713d6-149e-4096-a543-ece351b55067", "comment": "Malware payload (DanaBot)", "value": "80b5b9ab063c20e31fe018e04790a2e0", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603693, "uuid": "fc51086d-2209-4d54-9b91-0a1594892042", "comment": "Malware payload (DanaBot)", "value": "44f5331e906dd41bedfa27cda265c62d0afee5a4cc54d18c43bab13367355bb1", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603693, "uuid": "0f7aa521-db09-4819-9c6b-35c8d65edd92", "comment": "Malware payload (DanaBot)", "value": "46ef1d41f5fd7c9601250f2c88f3e7444af38314", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603693, "uuid": "88467861-de67-423d-92ed-75eb617e16f3", "comment": "Malware payload (DanaBot)", "value": "417d71d74d43f4abd38a923e0582c945e3af8e371d515c9aa3b0a6e3536d684e267bde2698746a5470f8974a25202320", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603693, "uuid": "57624d80-bca5-4442-9928-12261718d270", "value": "T1F5450231E6A1C034F9B712F895B983B8A52C7FB1576850CF93D5AAEE17202D4AD31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603693, "uuid": "84ad504a-6481-4eed-b6b8-97a20c1bd832", "value": "3808cf5755aac20ce0592be1a9bc0f0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603693, "uuid": "ddf628fd-e007-47fc-b182-e6139df497e8", "value": "24576:V6E5R3KVcpLFO7WB0Ul4ErLvZv3b3l6ylYlR7LmiIA:JR3WclabUl4ErLvZP7sgaBLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603693, "uuid": "c4d652fc-c834-4d39-9ad6-94b8961f1f91", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603693, "uuid": "bfbe6135-5a8c-4515-9534-5f75b9c8976e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603693, "uuid": "8e1e0d2e-f6b7-4175-9ae4-66b32ea480ed", "value": "80b5b9ab063c20e31fe018e04790a2e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4243c698-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556758, "uuid": "15cef174-a920-4de2-b4b3-85799a8dce64", "comment": "Malware payload (Gafgyt)", "value": "f91277090ca52a30be7e57390c18588a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556758, "uuid": "596f3533-ed1b-4f99-8dc9-8c3ebacf6d7a", "comment": "Malware payload (Gafgyt)", "value": "461d72d8c2aa49356caefa0a302ba318a4a43f3bdcb5eba77612d00662945c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556758, "uuid": "d6ec9510-b52c-4dea-a50a-4a7491dce348", "comment": "Malware payload (Gafgyt)", "value": "6304bdf25560adf6199660b2465c2055b5961cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556758, "uuid": "e279175b-d47d-48b4-9b53-33837ede52f9", "comment": "Malware payload (Gafgyt)", "value": "a2b1078f9bcfca4142a395084766d4931ce8415aec62db171c3a8f4b31d6d474e60fa72001ca409c8663dbf06fc21b6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556758, "uuid": "e359d4bf-3623-4d36-9afd-f26339f6aa3e", "value": "T187A2C06CBE0368D5D19EC8F412F153533C6A07A89503A916A588E7C3CF4E8B97ACF4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556758, "uuid": "04be2b82-3656-469b-acff-a6b13d7bacd5", "value": "384:rULuwbbSduOd7/xj9wiFbKmfM4OuwJ9j7a5svyenBYA+JJgGlzDpH7uNj1JZIuEk:DUbSdVhJj9nFm4Pwz7a5AfnBZ+JJgGlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556758, "uuid": "f577878c-40b7-46e0-979c-8bdcb198ce5f", "value": 22972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556758, "uuid": "a572efcb-66fc-4a63-bc36-2ad13502df64", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556758, "uuid": "09bbdc79-ebad-478d-9680-b7c2452c7122", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.3249.30432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8559b9-f9ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628580904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580904, "uuid": "cd269661-ae77-48c4-bb06-1ccb949c6513", "comment": "Malware payload (AgentTesla)", "value": "9df0d013e0ccc6e3eb28e9af6571e181", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580904, "uuid": "c1a797ea-a9f4-440f-b8e1-d3d821df7ee1", "comment": "Malware payload (AgentTesla)", "value": "466791257b458d251d62ded1a30e5b37299e3c86653c3e8688169d586b2f9834", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580904, "uuid": "286e3b17-c122-4813-b7a4-cf9d3028d960", "comment": "Malware payload (AgentTesla)", "value": "ef9e48a15e0e3618fa3cc26a4d1e5147934cefe5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580904, "uuid": "0bb8e4cd-7b74-417d-aed3-42ebbfd2a8d9", "comment": "Malware payload (AgentTesla)", "value": "3e6f4f544f041a6fcfe311f49ef3976170fb8de804b6e255996114aa4cc3a89331ace797953ad28fdab73da4086f8261", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580904, "uuid": "5107459c-5fe6-4bb9-a4cf-714b41e96072", "value": "T10684F12539C1C073DA73243018F8E6F19A3DF9722E619A8F53610A3A5F31693961DF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580904, "uuid": "576c362a-4e1f-4a13-a9f7-b03c86edf759", "value": "d4cc1601fd324eebfdf856765dda2bd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580904, "uuid": "45538598-e595-4000-9ca7-284369e06151", "value": "6144:Uf+5hhLDGoDfpDk7iJ+RuE2tf75jrmZ7U+xF7ZK4tJhXQ+pkkcGSPL9:Uf+1LDGoDftWiJw1F7wCJ6+pkpPL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628580904, "uuid": "096be707-a77f-4acf-96f1-17419fa4677a", "value": 399795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628580904, "uuid": "9b9d6589-0eb0-47e3-91c1-a785f7a52c1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580904, "uuid": "00dcadcf-1d13-4105-81f3-624c9cdd739e", "value": "PO FOR AL_KAREEJ NEW EUROCLIMAT PROJECT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce483c45-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628578468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578468, "uuid": "9601b8fb-df1b-43ed-b0ff-d812240d55b3", "comment": "Malware payload (SnakeKeylogger)", "value": "210f37c353be6b2739eaba795cd9b65a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578468, "uuid": "81031ff3-14ae-4688-884c-611ebbc0999b", "comment": "Malware payload (SnakeKeylogger)", "value": "46ace3d6e4ad85d164526928dfc1827743f1f9caa7b46d342e211b807afaf55a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578468, "uuid": "2afb4d0d-b1a7-432d-a3da-6feaeafeef2b", "comment": "Malware payload (SnakeKeylogger)", "value": "20bc7ff1b8e44e954290cd243d5f4eecb165b52a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578468, "uuid": "3e6e0ed0-cf6d-4281-8415-ff1d7f678d74", "comment": "Malware payload (SnakeKeylogger)", "value": "ac1f0263d348525938cc4184ee499bf29cc832120446dc06d234754beef15c6bbeb595769ad7bfb055d9f8a7cc097a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578468, "uuid": "20e0215a-99f1-4183-93f3-9a7be9751aca", "value": "T1E405F10723809793C415DB7758ADA39706B0DAD9DEA1EEED3886752E1DE7301CE02B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578468, "uuid": "a5304ad7-7951-4697-bac8-1f90e299864d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578468, "uuid": "66b4e515-224a-48d9-8ad7-cd6bc2a86a7b", "value": "12288:R6rKqn3qGaNHEyC9/oR9gy5FHK7z9LQ5rMsYPCy+CobTDcQLiKE3dcF+P5FXpucl:RuKKPp9AR95yZAMszyiTDVWKE3zPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578468, "uuid": "268432de-bc48-41a8-bc5b-aee061135ccc", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578468, "uuid": "c04fafc1-3ebd-4555-b2df-951087bedbf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578468, "uuid": "7704d70c-4e71-458c-a1cf-a5f036fb6458", "value": "BANK INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd73fe7-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628600690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600690, "uuid": "710aac4a-19f3-4003-b224-4637d8e30361", "comment": "Malware payload (AgentTesla)", "value": "6cfeb330789bd161fdb256d2b4d1f017", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600690, "uuid": "c424e585-e446-492e-9e6e-f27e818d7cb7", "comment": "Malware payload (AgentTesla)", "value": "46ea55e01829987a8a2b5997f663705790b64133c21d367e64761edefafc62b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600690, "uuid": "2e495628-e282-4ff3-9ca7-0d5228cd60de", "comment": "Malware payload (AgentTesla)", "value": "343b47a553f9020687ebc931c7151abae34f8a12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600690, "uuid": "48b8cfc2-71ba-4751-9d56-78ca7b3e04a1", "comment": "Malware payload (AgentTesla)", "value": "e9a4aa9989a4c5fdc484216d3ccdf5e5831553422fdc37a66d232a2015d8de070540e2c2b76d7a02e7c51e8fa2ab2fd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600690, "uuid": "5dcb9de3-9ab9-4464-a5ad-75a20f2e5d07", "value": "T1D515014723908393C415AF37186973530BB4EAD59BA1EEAD3882753E1EE7701CE16B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600690, "uuid": "c845ac2c-54f1-4d65-9a2f-6ff243733453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600690, "uuid": "5d4937cd-b22c-406d-8f90-8333a43b5b32", "value": "24576:Tl9K+Pp9AR95w/56oNffAVF+lpkZGp6HPG8Jhe79b:HPpKRwBthSF+AOGP9he7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600690, "uuid": "17435e06-462d-4414-aed5-339f3b1e440e", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600690, "uuid": "7764ac8d-9a6f-400d-ad22-b20d4f1bc594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600690, "uuid": "8c494027-90bf-42cf-8c96-2029b4db1c78", "value": "RFQ 15112-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3671969-fa12-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628624459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624459, "uuid": "8e6bae80-accc-4d18-9fac-a2c187a638bd", "comment": "Malware payload", "value": "c8ed883d252f1679dadcabf1353f9003", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624459, "uuid": "77c6996b-dde4-4080-94a6-f1879007bd02", "comment": "Malware payload", "value": "4729a664f2ed4ec055806e75c199582d004a7f0e0e70a56902496a62a127ddf2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624459, "uuid": "8c228caa-cbd7-4719-8543-a149383c4352", "comment": "Malware payload", "value": "30820305c0763748ae4fe98ca78c4e989f2db9d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624459, "uuid": "f523f554-77f0-43d0-8a48-48a1304dc767", "comment": "Malware payload", "value": "f1d491f391fe172ccd9e50d17b70aa6041dd7c89352634df3e5b98f8e6fc73edae01339ebf370b72dd47db315f4e19e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628624459, "uuid": "b4b5c75e-7db8-4548-9c7d-2b803e4dd2d0", "value": "T16BE26205B700D95BDA948B320DD7FAF61AF03C04AF9E922F72857B6D3C7BA14C605691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628624459, "uuid": "d3ab4dbe-7b29-4145-ba0e-0428c730c016", "value": "768:HTCvtTM2wc3vW6xC/tS3I/5HAbykCl6kFr3gwG:zCvtTM2l3vWz/tyIGyhBuwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628624459, "uuid": "908b5276-36ac-4bcb-ad14-e3294f7f783e", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628624459, "uuid": "4abc3b8d-1fc4-4664-a875-9ab9f009947f", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628624459, "uuid": "1d2f9866-57ac-4915-a780-010eed6d761a", "value": "SecuriteInfo.com.VB.Heur.EmoooDldr.1.02CACCF2.Gen.31338.17880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7648ecb1-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628603660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603660, "uuid": "99105f1e-90ef-42e9-818a-41ca9668c934", "comment": "Malware payload (ArkeiStealer)", "value": "90b1cbe8134460ff59be5af18cfca2b2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603660, "uuid": "298b0317-7022-4062-8d99-8c81873d6755", "comment": "Malware payload (ArkeiStealer)", "value": "4734dc7db41e3950d25055f82a5821cd3cd06ece663454c354e80d82fbc731da", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603660, "uuid": "11fd49d1-fe13-41ae-ad11-17f74f3e3ca0", "comment": "Malware payload (ArkeiStealer)", "value": "7495b715042c9c5e76c6caf6a918320f15e3db73", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603660, "uuid": "4efa6094-d50a-4467-8968-53b2a1051e76", "comment": "Malware payload (ArkeiStealer)", "value": "bd9688addf64a3202900ecc2d38f8950fb89920dc8cb2d8b61a597b8081546542991236319f3699b88e4e94a415dc8a6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603660, "uuid": "70dc4309-23a7-4693-ab42-63febb52e227", "value": "T1BF748D30A7A0C035F5BB22F845B9937CB82D7AA1572451CF92D52AEE17346E8EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603660, "uuid": "06e99e26-87a1-4741-8b77-8a4a4eaf3a69", "value": "6dacec1c54365d76351cf2216eab7641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603660, "uuid": "1ccc0198-d864-4d35-ad7a-07e7b424067c", "value": "6144:9l0X2OyjAMm5GOC5vZau7I3eXCb192BuM1tOl:cX2OMAx5wBFs3KCb192BI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603660, "uuid": "3dc9c9ed-139f-4695-a366-100cb70a789b", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603660, "uuid": "ff870528-4d9c-444e-b13c-77682f92b7b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603660, "uuid": "53078c90-84a7-414d-8756-fb0689c29b78", "value": "90b1cbe8134460ff59be5af18cfca2b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e811709-f99d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628574066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574066, "uuid": "e0545874-0e26-4e61-a305-6b1057b99790", "comment": "Malware payload (NanoCore)", "value": "3b0f47a293f2fd98142a1787f045e51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574066, "uuid": "be6dc92e-c5a2-4a4a-9108-6db2d22078ac", "comment": "Malware payload (NanoCore)", "value": "47cd0c8ff24aa632057bf088d4215a613740a0934523095b017bb3bf439748c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574066, "uuid": "c9971d69-f095-422f-a3fb-b4c9aecbb33d", "comment": "Malware payload (NanoCore)", "value": "df3d7fa2a87423f0a7aef42d08fa5c9b059a1a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574066, "uuid": "528a90c9-6f66-4482-b4d0-96bf327a5d71", "comment": "Malware payload (NanoCore)", "value": "bdfc7b9e2b67a0b84f5fb711ae6105c338f881379f8f345dcf9e3f220bd397894df6e539c09b6a3320be8d9beb89f55f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574066, "uuid": "52f5477e-b39c-455c-b20b-d9192a3bf18e", "value": "T155F4AE2B2440825BEE7CD1FE6606414AF368DEEBF5CCE949EEC73242CAF1A43155161E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574066, "uuid": "abc549ea-56bc-43e0-8bf4-d37da9e94195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574066, "uuid": "235f8c72-23b4-4ef6-8d7d-3b86eb41fb42", "value": "12288:dnoU/n5vdnlpUfWS3TXUPqS00dfw8h38Mt9jv6nnjqKoe:Zn5vdnlpwWukXfwK38MtN6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574066, "uuid": "f881e5fa-8615-4f30-9ea2-23dea23b67a6", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574066, "uuid": "64e27a4d-ef53-460d-a312-9a11e64dcf8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574066, "uuid": "681ba57e-acf0-45bc-ada2-377418f7a026", "value": "Memorandum.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7871f3f2-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628603234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603234, "uuid": "7a589fa1-3fd7-4c19-9fd9-8b6dfc61fde4", "comment": "Malware payload", "value": "17cd02df54dda1e6754e3933ab172b76", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603234, "uuid": "46b27721-da88-499a-9ece-8c6d6f66dd9a", "comment": "Malware payload", "value": "47f6332f0c6d7a85c3b1d648af381e288c028f959b6b4e5833ef496960ae2bef", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603234, "uuid": "bb4655b5-c75c-4af0-b26e-c98dccc5b32b", "comment": "Malware payload", "value": "842d1f62b98c03621c5f10138f06f53602d55bd2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603234, "uuid": "30efe959-1382-475e-97e4-a16e4a502b42", "comment": "Malware payload", "value": "86adde05bd780e72d0c0b3d67cf4a0af422fbd5000a793315740e718c85d56cf5748fd6aa60505931f21f6958b0ab1f1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603234, "uuid": "445af9df-1972-41d5-b349-d326966fbdfb", "value": "T1D6C2E068D4EC0D83F922E1F60BA09CF1FEC0C7FAFCD9F2016D924C961A495E96950AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603234, "uuid": "21ce01b6-8f3b-40d3-9f05-d7d02184f395", "value": "384:sxS8rbcIDCyBz7fDA29GcdUCYnSlPNyS0EOv7e6GoFXcC+i96v8+uTUV4:sxSzInP9RdUnaQUOze6GYXMM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603234, "uuid": "1e3e74ea-47e9-4506-a6cf-0498cf083de0", "value": 25830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603234, "uuid": "f1a45467-5a64-41ba-a05f-4764ce7d679a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603234, "uuid": "bc971c76-72d9-4e64-b22c-d03bee74759f", "value": "17cd02df54dda1e6754e3933ab172b76.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2352e131-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561430, "uuid": "eb7f096c-928a-4f49-bf1d-370b9634c300", "comment": "Malware payload (Mirai)", "value": "ced092926ebe8e5a41feef8978e652a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561430, "uuid": "ce174c82-a4cc-4cc9-95a3-30b3ffa654a5", "comment": "Malware payload (Mirai)", "value": "48b2e4c9bd26b56cf91a19ef9f6127eb59ea42f557b50b1595063c97cbcced28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561430, "uuid": "725f0834-5545-4efa-9cc6-8efc3a14ab40", "comment": "Malware payload (Mirai)", "value": "31b60cc74f319695d7faab45551a9add132354ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561430, "uuid": "7baea190-c3f1-483e-afcf-b34f8c765fec", "comment": "Malware payload (Mirai)", "value": "903c88a7c0a0ed7272a36ec59a45f5da24824dbad4020832c104230cbc2a789f8dc482eb42a7e3f8ce695f5eb76add66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561430, "uuid": "acf0c81f-f1c0-4a32-8abd-8a8aa6090515", "value": "T1C7336B65E8295D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC671144FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561430, "uuid": "82c52411-dd86-4ab9-a669-b1446aedf6a3", "value": "1536:3a+BiFCYXjD2/FuhFzKbwBx/7URAYEYCF:3pioYXOt4VLyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561430, "uuid": "7379cdbd-ac00-4faa-8769-8b424240880c", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561430, "uuid": "38c4d0c4-f5a1-4690-8539-08194eb02da7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561430, "uuid": "ef724778-dda7-4936-843d-0d8704b824c2", "value": "ced092926ebe8e5a41feef8978e652a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6738a261-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561115, "uuid": "05ebc045-7915-4593-b760-7800a70ce244", "comment": "Malware payload (Mirai)", "value": "942f45874717d17f109012da777d25c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561115, "uuid": "bf7bb676-a361-4640-a1e7-7456984d0f4a", "comment": "Malware payload (Mirai)", "value": "49e8772dccf211b08751108e1b5d913d671e6108bb9e44ec6b1824fde6b81f5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561115, "uuid": "133eead3-2f17-4101-b4ee-8856dc303071", "comment": "Malware payload (Mirai)", "value": "963102e3e57f3f42c769947d2862edd6ab1a4cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561115, "uuid": "631859a0-4941-4f2c-82e5-3d421804c043", "comment": "Malware payload (Mirai)", "value": "6da66173359002174657e91425be0268850c356a04d5baadec2c2e4ab5d9e1f912dace12ad817d1b1da28645ea540fd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561115, "uuid": "4e88ba21-d44f-4447-9b78-ffb8b8615334", "value": "T14D73A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561115, "uuid": "fd8fe847-9ed7-46a9-912a-96839e578d42", "value": "1536:YZIJO4rSB6xXqzEIyCRIxuF9IJajZvGIyv:LPOB6qzEzxxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561115, "uuid": "3a335357-03da-49e6-aaa7-5f43ee75062e", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561115, "uuid": "c5765911-58fc-4215-85ee-533220252996", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561115, "uuid": "1d262007-3283-4948-9c91-59fc5b4ae5d5", "value": "942f45874717d17f109012da777d25c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3acf27b-f9d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628598690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598690, "uuid": "81ce2b80-db9d-40a4-a729-bc5866fdf3a6", "comment": "Malware payload (Cerberus)", "value": "50ae42ca4edd8edcedd87ef1b1f5b59a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598690, "uuid": "1f4661b0-3cdf-4afb-802c-68da62c39641", "comment": "Malware payload (Cerberus)", "value": "4a3003d957821eac626cd5c1dad68fef2cd566268af95b677079aa470b523b1c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598690, "uuid": "d84558d9-8c82-46f4-8a42-7bfaa760658f", "comment": "Malware payload (Cerberus)", "value": "a12363f021501d9dadcb394b6caf4ddca09e230f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598690, "uuid": "a2322378-62a9-4874-8a1c-5e601b212d23", "comment": "Malware payload (Cerberus)", "value": "d2d3d03d89e47426b17f167ec85cd3e893b0208fe52c5dd5de97ed7a1659492eca105b7aa9bbd7f26d70a28d8a0d4fee", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598690, "uuid": "681c3a19-027b-44cf-83fd-fccef4630991", "value": "T162D3F183A7E0143EE07FB7304BEDFB726BB14994A6E1A3D32C0690589CB56931E5CE15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598690, "uuid": "86b267df-343c-4e35-b9ce-2fd7ad950f14", "value": "3072:SESdv4FAZBIEC67sGJDp7kWM02uLuIQ2XzXcv0RY:S1lyyIu3JN7kb02ovQ2jsv0RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628598690, "uuid": "9dc9fac5-e1f0-4934-956c-25ce1651f5cf", "value": 136629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628598690, "uuid": "a68aa474-b33b-42e1-8107-5ef33a2008f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598690, "uuid": "9d3e08fb-bcf1-46c6-a2f3-1986e933c944", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef15282b-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628574657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574657, "uuid": "88c5c6a5-90f7-4ae9-b408-706cbaa2c04a", "comment": "Malware payload (Loki)", "value": "67c6b42042053c3612e928cc593e85a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574657, "uuid": "96efe5aa-97c9-4f05-bb4a-0e43367110f0", "comment": "Malware payload (Loki)", "value": "4a6b31994025e7a6dcfeab2954dd3ae8aba701d227ac5b9684ca97e1031256c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574657, "uuid": "eef454a1-b85b-4f67-8530-5c0901cf0c4c", "comment": "Malware payload (Loki)", "value": "376def01c75feef9ec278980d6bea94661d05f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574657, "uuid": "1cbbd04b-2add-4aa1-8361-33bfb597d86e", "comment": "Malware payload (Loki)", "value": "e97e4245e809ac659bd65c80404d0816b5a74e833e9d0464bef56217d1b3963d2dbe72c6de4567ed2b02567cfadd6fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574657, "uuid": "85d9d678-9ff0-41ea-bb7c-4c82e91455c8", "value": "T175340102886BCA73C18F537962BBDB6B34263694A74869C71868ED6E0CE17D0137F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574657, "uuid": "39360da9-cf5c-4e4f-b4eb-1cd749b92851", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574657, "uuid": "d314a98a-da00-4a8d-b829-f94b2b5533be", "value": "6144:/SpPWOoH3PhpTCjBUN65+VLRMQg2d9VPdyGY4qkMp:YPWFZpTCjuN0YL6Q7V1bqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574657, "uuid": "5b2b78b6-e895-48e2-8144-7cd5d4efdbf7", "value": 236429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574657, "uuid": "80915fae-9a47-4edb-acaf-ed684d82e8b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574657, "uuid": "0f05f157-c7f6-4815-8b61-690749908c3a", "value": "ekema file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5b7357-f9e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628605766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605766, "uuid": "7b3bed64-89a5-4d04-b085-6a150d9293bd", "comment": "Malware payload (SnakeKeylogger)", "value": "ee3071fbf7d91381442734c6145a11fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605766, "uuid": "78463b3f-b817-45a5-9fc7-b5a9ef368d90", "comment": "Malware payload (SnakeKeylogger)", "value": "4ac9b6a9a2e4787dcf2f85ac31200933d3e3a01b9a0410c13ffc46277a1d3a16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605766, "uuid": "e05f249c-4133-46e4-964a-39b9174778a1", "comment": "Malware payload (SnakeKeylogger)", "value": "ba0a843115aa24d3ea4734f9329d5b19ed435c20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605766, "uuid": "584cb473-483b-4f74-ae45-668bf51c90fb", "comment": "Malware payload (SnakeKeylogger)", "value": "aab2f650254d06add6ea0fcbd6ec68883db1c8b995c59b257b580726d868ac4db5dff07dd6c506bb6a7a7dba48d5caa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605766, "uuid": "c9440e87-c340-4bc8-a1a5-84f6d8c406e2", "value": "T1F2F4D0693381BB8EC13E4E75C8521910DBE0E77B5707E3C77DE644EC8A8D6868A23257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605766, "uuid": "458ad4fc-c02e-4b22-8469-551ee13c4eaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605766, "uuid": "ddca9d8a-36b8-401d-938c-7a4d2e44d1f5", "value": "12288:+HauZjuFWsGB55UXkktw4mMz0VLmkeSsqqYvz+q84n86oAH5cC0oQJ0VU5V6fJKT:kZjNhuXkWwxMwDenWz+28mHSUUP6fJKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605766, "uuid": "1f776609-f90f-4220-9ad9-c7263444f18b", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605766, "uuid": "5c5bf98d-739f-41cc-962f-16b2bc16136c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605766, "uuid": "6036be38-6d8c-4adf-8f8a-9859275454fe", "value": "ee3071fbf7d91381442734c6145a11fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c835c24-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628581203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581203, "uuid": "78c35d2e-ecca-415c-ae40-1a21bff72d96", "comment": "Malware payload (Smoke Loader)", "value": "2ebf3f51d4ee6f22482b54be5bf98cf7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581203, "uuid": "c4fc8f4c-1abf-4727-8a86-a85e13592b53", "comment": "Malware payload (Smoke Loader)", "value": "4adfdb564682cb936b002c4740e589a698097618d04984287e67fcbcfa48a8bf", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581203, "uuid": "5a971880-0fad-49e4-a734-09c33b71e71f", "comment": "Malware payload (Smoke Loader)", "value": "1c165b56b64ad55ccb3c9b88629c16dcca3fa7d5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581203, "uuid": "8400db1c-a2bf-4bca-b882-2d5c1ee5393b", "comment": "Malware payload (Smoke Loader)", "value": "ed1f73aef828d793d134a7e50cd75ce12d4aacfbe289e6aabb23c2885592d02cd81ce9059a4079b164fa849880e879d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581203, "uuid": "e6f379e3-bb92-47d5-9320-5e3c770fdbdf", "value": "T1CA249D307580F872F497867078ADDAA4F779FC206B24524767983E6E6E333D0137A25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581203, "uuid": "f1203698-a388-42ed-9907-265c8bf7a30d", "value": "97856e36aca27ff13ae687d21f9f6f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581203, "uuid": "6f2ccc69-5ead-4459-912b-6dbcf604e809", "value": "3072:OiXPtOlUsEV2NCj5HO7YWnexbnCNeoBNTfC8IU:2l/22stxWeZCIwY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581203, "uuid": "b80d5558-5ccd-4e4a-b3de-2600963ba24a", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581203, "uuid": "8bf5b69b-dfa8-4788-8625-86d0e78161ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581203, "uuid": "d2b2d8a8-ac6e-405c-b5f0-82418b0ba65d", "value": "2ebf3f51d4ee6f22482b54be5bf98cf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811938cf-f996-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628571037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628571037, "uuid": "e983bd42-8517-4228-80c8-7b311323b2fb", "comment": "Malware payload (Loki)", "value": "1f8eca4417277440bd6b9984b167e9e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628571037, "uuid": "588d197c-b1cb-4163-8041-c73b9dd146db", "comment": "Malware payload (Loki)", "value": "4b01e9fc537905b7892064c0f8068e57d4412d358528a9d588c7834a4504eeb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628571037, "uuid": "550b84dc-b0d7-4664-82ec-175db3e826f5", "comment": "Malware payload (Loki)", "value": "2c405e01e965373421cb0e697ad6c9d9446ecde6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628571037, "uuid": "6bdf18d3-1b0a-425d-80df-efbc8ef46c7d", "comment": "Malware payload (Loki)", "value": "a5ba4797ff3bcdecb16808028b29e15d98f2a5c44ff07e14a5c109d45aaf52eb2c9298a6250a5bf864a2be84c3985c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628571037, "uuid": "207cf483-c432-410f-8fe4-7e94d136a970", "value": "T1B6F4DF613790FB8EC63A0E75C4515510DBE1E2735707F3CB2DE219E85A8E6864B3336A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628571037, "uuid": "6a3ac257-a6f1-4388-917e-8b9396d047fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628571037, "uuid": "7cbe2894-0b08-472e-972c-d088459cd181", "value": "12288:QJREKLt0MMAugEGOULDpfrz+ekj7SGqVuXpRuh3nYaOMP43vJfD908uEeV42jerO:QJ9DugDFztkj7dqVM7aOh3vlDu8uEM4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628571037, "uuid": "41d103ad-c8ba-43b4-b108-4fa15a9aedd9", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628571037, "uuid": "9adb41a5-4377-4c41-8ccb-a16b2e4909cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628571037, "uuid": "10bae0ec-551e-4a27-b403-5574b748075f", "value": "Order Aug 9, 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5f0c79-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628574461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574461, "uuid": "d51c386a-e52e-4121-a872-f3847b5d4b1f", "comment": "Malware payload", "value": "ef7de9ecf7cdaa9962de2cbf5e36957d", "object_relation": "md5", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574461, "uuid": "d85047f9-cedd-4325-8f2d-aacef9767278", "comment": "Malware payload", "value": "4b7c2f4b15979a9c9713475094c651a2d517a122da666cb2233132a8687e7cdc", "object_relation": "sha256", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574461, "uuid": "536c9fa8-e06d-4e9f-8daf-2a3561f02599", "comment": "Malware payload", "value": "0dda4873338ea9ae82661e65c46d67d10466e51e", "object_relation": "sha1", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574461, "uuid": "37af2365-333c-45dc-9a51-2947985a41fe", "comment": "Malware payload", "value": "940c126a0d7139e1c337d17dba65d98ccd5a9bc5bfae51486681d2d19f6b027e2bbfae2111b11cda2c2f3381c3b50f59", "object_relation": "sha3-384", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574461, "uuid": "8bd03f67-9233-42d8-a5f0-a4d34458283b", "value": "T11E22B02E1FC1549433BB5AD1BA9DACA354B62EB6C535938C4F3835B2904E0D13DF1A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574461, "uuid": "8c542ad1-d35c-4033-a05b-172192bfbaba", "value": "192:an6X5o8VSGOJsg7+ME+V9c0HlSHVOy3WPg8rwcMwv9wNEkfei4H13uBYGEpuXmsW:VjgEg7+MEoc0Hlmzsg8rXiNEkfweBYGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574461, "uuid": "65459917-6562-45d5-9a2c-c49855e0f912", "value": 10241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574461, "uuid": "844afa09-261d-4bf1-a9e6-85adb0afee8c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574461, "uuid": "3083a172-c2db-4fa4-9ae0-f9638c6de9f1", "value": "Pensa.vst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e8bc09-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628603200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603200, "uuid": "b7404e30-ec4e-42dd-b0d4-12d3f3f465a1", "comment": "Malware payload", "value": "4374f34591137ac5f4e6f28f5a82d132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603200, "uuid": "80753005-b0d6-43d4-bf57-ed3f2920da3f", "comment": "Malware payload", "value": "4ba9cbfe172e8625907e721f987933ff72b4daffb5c627729815ac8f8a4e5286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603200, "uuid": "90413192-03ef-4e47-a024-e358a394a930", "comment": "Malware payload", "value": "b91eee0b82fd3d2e677f13aed8c08854e2d435ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603200, "uuid": "75f1bdc7-3094-475f-9c29-cb3eddabc1f5", "comment": "Malware payload", "value": "67f9e6a73606b32aa82233a2f2e8f29b7ad8a6e145560e3535daca7da1558d08ab219df02814ebffc9fa6c8739bdbee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603200, "uuid": "142315dd-0cd4-4741-a083-a40ce6fb5508", "value": "T1E96401D1CF61D20AED570B389ABA6E3862BBFE90FC7D430D6501742279BFBE52809441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603200, "uuid": "f3ac34a1-573d-49d5-96a5-b48352a1b222", "value": "b355ef0f8211aabadb8102dc64e53bb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603200, "uuid": "7f8974b5-bc4c-46c4-9704-781d6c9759f5", "value": "6144:dWlcYZd8ojJH2hgeHt4IRSfViwjsX144fiQZTj2vjN83MUKwsFmUpKx:dWlcodVJW1NRSSX1nuN39mUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603200, "uuid": "6a95cc5c-023a-4449-ac25-31bec198c61b", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603200, "uuid": "16ff0431-4e1c-4bbb-9819-c0602f0f8878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603200, "uuid": "1782a187-1d57-4c1e-b1f7-ddf84f959b27", "value": "4374f34591137ac5f4e6f28f5a82d132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff110e40-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628581556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581556, "uuid": "d7cb5ea9-392d-4dbb-8238-5a322a9557f2", "comment": "Malware payload (Formbook)", "value": "a7d906e300e394d87092e5915aae4218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581556, "uuid": "7fa10748-edbb-4393-8d6e-e9e1e1775125", "comment": "Malware payload (Formbook)", "value": "4c3c596f1205356635a9ff0ad1a179f8c739cd9e4026085e091d5bd0d0173067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581556, "uuid": "99b1eaa2-3bcc-4bea-97ba-78dfacaa8092", "comment": "Malware payload (Formbook)", "value": "fb9386cc654c66257c150e2f3fad96cb6f6f62ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581556, "uuid": "093ebe50-8aeb-45be-a515-13579729a155", "comment": "Malware payload (Formbook)", "value": "70473a804d8d5acea66104327b001c0d325f9e975b78321a0ad769ce6bb480b9acb0c2880f6f8c6e5e67052e80374d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581556, "uuid": "7a337ed8-fe42-4dfc-903a-2feac77434d0", "value": "T18635E046224042D3F837BB72745FD6510665EFDFE7B0E99F3A823E291EB73418912A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581556, "uuid": "bd1df49c-4b53-44cb-ad7a-7054e95a2e8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581556, "uuid": "9bf57a21-4c45-452c-afd9-64e77a92d204", "value": "24576:HlKZPp9AR95yifpU0ZBq2EEUZdvdwsJwYiBkXMGl:aPpKRyCBqvEsvdwsJwYi7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581556, "uuid": "1c2f855b-747c-4fde-8d3e-defca0d32ab5", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581556, "uuid": "f5af5198-1271-4a2d-905c-27def84e0053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581556, "uuid": "e1c78de2-0a95-4f60-aeaa-6b25ad49885f", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.2343.27176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283e6bdf-f9c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628590215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590215, "uuid": "51a8f8cc-9d03-4153-8257-db08123e83a9", "comment": "Malware payload (Formbook)", "value": "ddafa2b44ec908b114a4c33431e0952a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590215, "uuid": "12fd0375-c734-4bf0-9e3e-6289a8bc5fed", "comment": "Malware payload (Formbook)", "value": "4ca6a48021d7d442d9311b158691b1f219576d7d37a99f64741463659903ad4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590215, "uuid": "057f7e8c-320d-4d4c-a178-b7d7acda2739", "comment": "Malware payload (Formbook)", "value": "e85c3f28cd859c6b5ab900c6a0c07a8fcfde8173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590215, "uuid": "3d326f2d-a7f5-457d-b005-373d8d92db21", "comment": "Malware payload (Formbook)", "value": "8a7235378013bdd986796f99955b5a589fb6ac61c644f8e4e6392b3630b55a3dd5e634ae5ebfb78b6a56b0f08c8e599f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590215, "uuid": "9aecbfb8-0540-478d-bb7d-f79fd24987dc", "value": "T16BA49C3904584A63F236E2B3C264E601FEF09AD3F241DE0D9793A5D71E122436ADEE5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590215, "uuid": "f01aa731-f90f-4bb9-ba8c-0b20f9664b3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590215, "uuid": "b7bf2aca-c1c2-49d6-a20f-55732e3feb01", "value": "6144:UEuRQAx7F0oJbIkfS6yLURmB2kC1iQvOhWfVqh9HZZzALTfj9H7C80kDq8a5O+FA:Y+Ax7DJ69251VYWfVgH837e6AFzdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628590215, "uuid": "93f4e0d8-fe4b-4081-b34b-e0e25ffd856d", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628590215, "uuid": "e6c96e04-8a04-4978-9b22-d0ea8aa283d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590215, "uuid": "77a93d83-0203-4620-a38d-42ea4d0b4e9a", "value": "XQFreZzaubEvXYg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029d3392-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628603037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603037, "uuid": "62be22e2-d213-4c00-8dd8-64987e3e812e", "comment": "Malware payload (Alien)", "value": "2c0f13b0cdce60ec006f155362da5443", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603037, "uuid": "a26b15dc-1b84-4161-8804-773a61743a1d", "comment": "Malware payload (Alien)", "value": "4d33c3c010f2110912208a54b5ca1f12df2aaed5615cf512dda4ba82c649eabb", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603037, "uuid": "aa1035b1-5272-4d35-89ed-d89015c0b8da", "comment": "Malware payload (Alien)", "value": "95a6959a752d9d0d2f11c902512f19aee7fb6787", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603037, "uuid": "77d26242-1e1a-46a9-8c8d-28cf3e9c145c", "comment": "Malware payload (Alien)", "value": "00b78156b2ab843ee9ddc6afa1e90c3437e7be985d61750b6a213192f29913d9873c28b72f2c94c1070d325d74721c49", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603037, "uuid": "fab98626-7882-49c8-b0ad-2182523e7bd6", "value": "T1E4D5335AE787840ED517437783076AC73A61509C4BE7BC7F0A7980991CA7EC48E1BCBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603037, "uuid": "0f8494c7-cc48-424d-90de-588491d13b8c", "value": "49152:Rd9FiO5lXJ8k5hRfUAfHN728s5zx0a9HkKWSbatOBAKVkekqa9WWaqckuCD5:/9FiSlXJ8k5hR8cNK8Q9VDatYQL9Wzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603037, "uuid": "4f8db213-1db0-43d8-b6e9-b81cb80ef9d3", "value": 2842504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603037, "uuid": "0558f398-c33f-478c-8c87-6be04d3b03f2", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603037, "uuid": "e41df634-573c-4c07-88bf-1abd3478a6fe", "value": "YERLI_PORNO_IFSA_VIDEOLARI.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd285ab1-f9dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628601632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601632, "uuid": "061693bb-7c19-4232-a8a4-c3967623f18f", "comment": "Malware payload", "value": "e791da727ffa32394a3c2580204cbbbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601632, "uuid": "21b49605-50d5-45a0-9f62-f7217ffc71e8", "comment": "Malware payload", "value": "4d7f7cac5b173360e403fd6dcd5c011328b324b77feabbfdd9c72641dd5dd079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601632, "uuid": "9c55b373-ee34-4ecb-adb7-5593ba367117", "comment": "Malware payload", "value": "d94b4bf86032d30c2a67eef0900695c04f14efc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601632, "uuid": "fac51ae0-af10-4b8c-a29d-ec00258f4b7e", "comment": "Malware payload", "value": "803aba593d064706f83e4be4cffb9db159f9f5bb9b95df3117a094532589a473d3e2927e971fa341bc87da5cdcbd56f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601632, "uuid": "53bbd418-4cdc-44ea-9221-299f2305996a", "value": "T13CA4CF60F141D0B3DA63047059DAD936056A7E389A704DCF67DA6F3D6F722E22132B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601632, "uuid": "2f1f5806-4d21-4ef2-977a-cb116a95e91b", "value": "211889fbd769218c7de88e900b98c2f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601632, "uuid": "47dfd746-bcee-44a2-bcf7-51de52d70435", "value": "12288:HFSgGPbKhiIfh/wWsna7WxHzm7v7HxewB:HFSgGDJO/En24Hqv7EwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601632, "uuid": "4a49b8f8-052a-4014-a99d-611beaf95492", "value": 479965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601632, "uuid": "9d075829-d677-40dc-ab06-ddcb3f220911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601632, "uuid": "a2c970e0-2cd9-4639-96d6-1ca76779d310", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150a41fe-f9f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611228, "uuid": "da577d54-8ac7-4259-a69a-84948b969b8a", "comment": "Malware payload", "value": "9d36fcbb8d01652a7dc93c713123ed1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611228, "uuid": "6ddefb2b-8e88-494a-9da9-fdbc8bed4f3f", "comment": "Malware payload", "value": "4df83e858a2d52987f6e9b8afcde20643ee1cd106089e412e25b1df186a57b29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611228, "uuid": "9dfd97b0-aaaf-4e03-b3bd-cd7c1073a135", "comment": "Malware payload", "value": "f85215dac3132735dcd7f25a287e706602108201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611228, "uuid": "0beec50f-c85e-43a0-aa34-7f67ff5103d1", "comment": "Malware payload", "value": "7a1422178cab6fa95d3c1e17a73652308af4838fcdbfd762d6361ccac9acd81d124cf263ce0cb6b46e72ab7bad529910", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611228, "uuid": "5f49c8f4-094a-4138-9436-b2fbb8ddfb6f", "value": "T1E026333096F0C438E47711B4452D9339663D7AA11FB1A1CFA2E42AE94B347F9AD3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611228, "uuid": "473c7e1d-3d57-49f9-b885-de7617303bc9", "value": "e3cf60b4d5be6f57956398dd6440990e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611228, "uuid": "ebd07912-b220-4df9-9bfb-4c9c4628a1c6", "value": "98304:osvPUk14CA3Y6nyp7kxUHFnGHPEVLo/23fSSte:odk14Rnyp7kxUh0P+LqCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611228, "uuid": "61c448eb-d43d-49d5-a872-d3b43972d4b4", "value": 4697640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611228, "uuid": "2ff538bd-2a14-4dea-a2ca-72d2cb1abbed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611228, "uuid": "5d00a8d8-408a-4f8d-9d8c-32c2af887570", "value": "9d36fcbb8d01652a7dc93c713123ed1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1697fe6f-f9da-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628600064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600064, "uuid": "bde4ef36-219b-4c94-b8ed-1bd64a11d3d0", "comment": "Malware payload (AgentTesla)", "value": "16df430e5c0a281265078df8437a8600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600064, "uuid": "85def105-28db-4bee-996f-65961811a670", "comment": "Malware payload (AgentTesla)", "value": "50026ecb266e341184a0db15b519d9480407ebaa4ca2e454e75c6f3820f18d5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600064, "uuid": "6e4faceb-941f-47e8-8c48-082a7cc3ce70", "comment": "Malware payload (AgentTesla)", "value": "c2a1a66ccee7c36287b68edb4e942b712f046db6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600064, "uuid": "9ad1f08f-cf15-4859-9577-5166eea96fda", "comment": "Malware payload (AgentTesla)", "value": "76696876cad523d2ef397b4bb8e14e1db69c6ce8470f61f33fcfe512b92e74a574aa4afd5ad08e404c72bb2cd0a8d749", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600064, "uuid": "38aac002-c9c3-41cc-9283-48fb01bd7567", "value": "T11A25AEAC3263B19ECC27C9B2CD685C60EA257C7A431FC217501761ACAD6D9ABDF501F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600064, "uuid": "6a4bdcca-dafb-4020-a942-214fa0107ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600064, "uuid": "e5096cb7-4684-45f8-8308-0ecc64062676", "value": "12288:6UO8+wu6b97L7CYc1CQvyw250fMwk0E098lAJTuJSz48fBwXp3yaUVKnpurARTdy:6UvuEqYc16ak079NJTESM8fBw5iahpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600064, "uuid": "b77d18cd-de69-4a12-8f47-6262a8747f23", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600064, "uuid": "2001dec6-d0d4-4232-b3d8-c98a510b6bc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600064, "uuid": "a7548624-472d-435a-8d55-6c8fdc133a12", "value": "SWIFT transfer ref#no-1161F325401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b23bef8-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628576449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576449, "uuid": "869c170f-d91d-4a34-aaee-025b5f9dc8ef", "comment": "Malware payload (Formbook)", "value": "10241bcaf9091d440d1015c38ad2067a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576449, "uuid": "e0fbe0d2-5b06-41eb-8d83-6705c628e811", "comment": "Malware payload (Formbook)", "value": "50b4b3009a096d533f62db068a152cb6e5a100c57c0946420f1e60d41c1b4f7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576449, "uuid": "75ee6522-3915-443c-b769-c4b608cf3c84", "comment": "Malware payload (Formbook)", "value": "e76f5c3d6825d7506ab2eb835c37da280c59deaf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576449, "uuid": "0651d60a-e1d1-4f42-94e4-e5e4881ebc17", "comment": "Malware payload (Formbook)", "value": "23e082b3b5dcdc5eed9776dc291528debbd9a41e0dc018d4d1b47d08f10c026adc214d7c4f565c2b82457da8572ce953", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576449, "uuid": "3e6728f2-0b13-45c8-890a-23f7dc039551", "value": "T12A23DCACD45742A4CF86A7B8672BAF05118CB62DF7988173327CA77457E1D7A802387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576449, "uuid": "32222135-2f36-4716-9c5c-329ecdfa283e", "value": "384:5WFtNXEN6RtrZCIiSDCDTNMpbGl/22FGu:45qIiS+DTNMYl8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576449, "uuid": "5bc1c532-2548-457f-bfda-fe5273e23fde", "value": 46465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576449, "uuid": "6e8d0747-a547-45d3-a03f-33a8587a5d97", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576449, "uuid": "d878e018-be80-49cc-94aa-8413e4a87aa5", "value": "AL-KONDA-PROFILE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b97646e-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628600716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600716, "uuid": "07941427-d3e0-4021-b163-fc3fbf5339de", "comment": "Malware payload (AgentTesla)", "value": "c4de12a83203a8b25d8077c00a9c2bb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600716, "uuid": "e200ff0b-78c1-47bb-8d9d-200ee1dea0fe", "comment": "Malware payload (AgentTesla)", "value": "50faec0d59ac135c1da8102a99219d54fdd12d00a3d0cb5bb1168ab2bcd8a10d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600716, "uuid": "56b90287-ad08-4f50-bc66-f05b86abd06b", "comment": "Malware payload (AgentTesla)", "value": "7643ed89f3a180e1bb0b43974a2a020c06c99c29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600716, "uuid": "6dd25cf4-51ec-4754-a0b6-495ea9c432c6", "comment": "Malware payload (AgentTesla)", "value": "555105c820313ad6e2d8a5e97c1ebff3afc7c0cd1c65770704d853396e222c10e6bfc4d2490e895086ae883465326f91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600716, "uuid": "db40a56b-4038-4ceb-8dd3-7a25700a1067", "value": "T1A4A108B5193C6E81EF578452ED39FE6A02E3F1429BDA1DC8328EC950076FB127820A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600716, "uuid": "917dad34-9f52-49e8-9304-af208ec39ada", "value": "96:Jgu2PdvS6DpeMmT80LtB8mLmdsMMnA8tNga0pQYV+kUBnTNJhT5e:Ou2PdvS6DMMmxJSmKb78wRKIhU5NJhTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600716, "uuid": "22ef8331-0966-470d-91d1-bdb40f186cc1", "value": 4816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600716, "uuid": "6356dc17-6185-42dd-bb1d-bdc20c655a46", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600716, "uuid": "7fc9fc8a-fe13-46f9-9dd7-27d454a02752", "value": "Revise Invoice Bank Details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c8acd9-fa08-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628620143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620143, "uuid": "1abc0f27-e22d-4c31-aa17-ff32872078f7", "comment": "Malware payload", "value": "e128aa32a49e33052293827a6cb1cfa5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620143, "uuid": "6bb4e21f-7733-41e4-b099-d7885c3e33fd", "comment": "Malware payload", "value": "51bf7efcc3be6bdd787b7b675a59cc6aaca66ddd043451d17882164c71c91b7b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620143, "uuid": "e06e3e58-a4d0-48bf-bb45-acb8492f44ec", "comment": "Malware payload", "value": "424c2a1301c7d96c02e94c07d1b76360948ff666", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620143, "uuid": "a3023f47-b28e-4cda-8259-ebe457f8f6b0", "comment": "Malware payload", "value": "b0d1d321a5f9d586d7c92ef43ac2ab113bb7653d485f83dd46c0383bfc2172cc49d927dda7b22e7c175b40d2b45b9943", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620143, "uuid": "e059bf7c-fdd1-4e27-804c-b8194e088e49", "value": "T152D3F193979024AAE07FA9F1259D937717738AD4F6F1E3D32605900CACA27670F8CE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620143, "uuid": "84cfcb28-6777-412a-9282-6e7edf1ad192", "value": "3072:MYNP9LiLPSGibrJ25c07juLuIQ2XzXcva2U:MYNVASGi30/ovQ2jsvaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628620143, "uuid": "74fc59b0-b718-41ce-a9fe-400c66f984f7", "value": 136627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628620143, "uuid": "930da25e-a121-41d5-b7f2-5b77c482fcd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620143, "uuid": "3a3906b5-3868-489e-ac24-24c76c74c92e", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3bc377-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561100, "uuid": "6174a033-e935-4da8-94f0-3adfdf67192d", "comment": "Malware payload (Mirai)", "value": "4844b5cfafe285ec1e874010a9249df6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561100, "uuid": "b2128e76-38b5-4275-96c2-93c3c39a7aa5", "comment": "Malware payload (Mirai)", "value": "52c126e6739e8e03c0f7d06565dfeb1997e35b101774418dc81e9b6ca1acab61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561100, "uuid": "36ae09d8-7120-4b28-9b5a-6bc13302608e", "comment": "Malware payload (Mirai)", "value": "d2e0abe59031a281e10a24a2e819ca277106ec3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561100, "uuid": "37ed22d7-0d91-4365-a373-12e019fb1ae3", "comment": "Malware payload (Mirai)", "value": "0fa0f8eca74caec4f587fa249c2352473fd41dc7ee9f743b5a8601c4578f2733f9fce87d7b2a46855138e815ad1bf40d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561100, "uuid": "6b5e38ba-21e1-4991-b945-6bf6c1195f8c", "value": "T1C3430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561100, "uuid": "d54c8268-aabf-446a-b849-6ea43e521999", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7u1suV27cghMDHs:Q6ia7d91b273hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561100, "uuid": "e7d73ed1-be06-4941-8409-a64f297d8d52", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561100, "uuid": "b665c9cd-7801-4313-b679-36248f917fef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561100, "uuid": "78cb9878-e48e-4d10-a0a2-3ee8cf730bcc", "value": "4844b5cfafe285ec1e874010a9249df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213cf33f-f9d8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628599223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599223, "uuid": "7c0287ef-65cf-46a6-b3a8-6f1295137832", "comment": "Malware payload (AgentTesla)", "value": "91ee6d8d4d037a04e54b072e7f5eeac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599223, "uuid": "ada46d9c-e5a7-44eb-9916-ad4fe14c37d2", "comment": "Malware payload (AgentTesla)", "value": "54d1484a3caa64a31b8c24bfc564a47623ad4867319015e0678b559ab4f17d33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599223, "uuid": "d540435b-a7e3-4e28-8b66-76b02f7d7b36", "comment": "Malware payload (AgentTesla)", "value": "4b6bb42f0f69bd0950c3678db1e5aa3e16602c83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599223, "uuid": "c8ad7608-0a4e-44a0-86cb-0f84ec4dfa23", "comment": "Malware payload (AgentTesla)", "value": "33f016ee3012627c907cde031a2c20d17838d6b8baba36c2e987d7631c5da12ff6a58055590e64d248daf0f11ab71ead", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599223, "uuid": "d4033fda-6462-4240-9397-d688578313f5", "value": "T14225B6414A8FC7BFAA5B12F0082C109C94BBDD2EC209BA79BE0F4D76B562FE5117D485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599223, "uuid": "91aba68d-5ba2-43c5-acf7-74515af978d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599223, "uuid": "4edfdd9a-6740-4e5d-8330-d261a4a8b406", "value": "24576:2NFW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hu3Y:HieckUiBROwiUhSNwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599223, "uuid": "3aa4c8e0-f309-4772-a406-a3062e14a9aa", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599223, "uuid": "714bdaf7-df06-4ba6-bdd8-eaecc3ac0eb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599223, "uuid": "11fb14c3-7c49-4c02-84a3-3e97429bf804", "value": "SWIFT transfer ref#no-1161F325401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca089be-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628600611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600611, "uuid": "4f8e302d-726d-40f8-aa76-132f0da718ac", "comment": "Malware payload", "value": "c19a65475707996513b133677e69a522", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600611, "uuid": "0f491c9b-56aa-4130-8e64-c32facf04397", "comment": "Malware payload", "value": "55182cc6e4c24197888074d012e22d366971c53a653e9544e9edbc6d37b5ba5c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600611, "uuid": "d16de372-5cf3-434f-9332-91edf1e5c67b", "comment": "Malware payload", "value": "b3a325e0f5376ce491e77518d59796845f3b3ebc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600611, "uuid": "f6a5e3bd-db53-4ef9-bd4a-c43ec4ba0ce4", "comment": "Malware payload", "value": "8724136c5e04a067f140018b49be2d3c27061fbfc7e9d1be9bd5b5886d86f245e17977322df0fe445d1b070e3b179eb8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600611, "uuid": "f04c40ec-14e7-49f9-a5a4-ebc71a04dfb4", "value": "T13F448D0673C94679E8E70331679BC322DBB6FC3486238527568A760E2DF1594F6633E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600611, "uuid": "2027a3ae-b3fb-4515-887e-cf7f1054ac2c", "value": "3072:2zD5FT0xcM9a3DUY5A2U6ij4qpXqnnDibAJBVkMuz2L9rQn4J9+3Z5yOV2nWW:E5qmZ3DUY5A2Tqp4nwEGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600611, "uuid": "5c5122b7-7a39-43bc-baa6-775f45cd1e60", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600611, "uuid": "68e6ece3-e015-4dcb-ac5f-02196a2c5e9a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600611, "uuid": "0bffc33f-586b-4397-8c1e-50972d15a5ab", "value": "minha-conta-13082021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b943abf-f9c2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628589952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589952, "uuid": "c0fbbb7d-ccf3-4389-8234-dec5fedc3ebf", "comment": "Malware payload (NanoCore)", "value": "1fbff46d0b659b0ddf5af64ce0886a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589952, "uuid": "d1ec50bb-62d8-4201-bcdc-7bad70440e4c", "comment": "Malware payload (NanoCore)", "value": "55ecfe3756290aa2130836b547dc6b3fa0dd3405900ea940c6b30da89889d010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589952, "uuid": "3e8da47d-7187-44e2-98fb-59a59747abde", "comment": "Malware payload (NanoCore)", "value": "4d2f337ea22e0a21a39748339e668475e4758ca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589952, "uuid": "506d889d-1ec5-4a87-b798-424efb5b446e", "comment": "Malware payload (NanoCore)", "value": "233487b783f68ec41c9990c80a07770e52f53f3b3a231c579c7ee7b785b2b59f58668c65ea1a20c1d46e73ab251234a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589952, "uuid": "bc6612bd-5ea5-4d33-8bed-47c65451ecd6", "value": "T176F49D1B2440815BEE7CD1FD7605414AF2A8DEEBF5CCEA4AEEC73292CAF1A43154161E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589952, "uuid": "0b2904f1-01b7-44f1-80a1-0e60d93da3b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589952, "uuid": "ca92f634-43fa-4839-a6c8-69b62cd01c9e", "value": "12288:sxVhAiHeMJORYCQ0mTnrxSceYVXy9wM3uCBcurrv6nnjqKoe:ShF+cORYCQLrxSvYYwM3uCBcu/6nnjqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628589952, "uuid": "4fe49a07-66c8-4513-a95e-43773fb01cfd", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628589952, "uuid": "0ded7e0e-5887-460d-9af6-81e4f03f7d58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589952, "uuid": "7f79c891-b31e-47d7-ab4a-1940f9ece76f", "value": "MANILA LGU VACCINATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1408a635-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628574290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574290, "uuid": "3f3b77b4-419a-4ec3-b593-f54395452624", "comment": "Malware payload", "value": "cd8db6e405622b2c9b2d40b0e12635b6", "object_relation": "md5", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574290, "uuid": "305bd266-bd4e-4cf4-9c04-c860ba7f1782", "comment": "Malware payload", "value": "56ec3bb307c6352d5c0e8a7d83725361add6be69666af29e4f899261daf1781d", "object_relation": "sha256", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574290, "uuid": "f3750f49-8827-4eb3-9a19-320d62f4c041", "comment": "Malware payload", "value": "e06745b817a1304eac230bd2a9bdf1a962858ae3", "object_relation": "sha1", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574290, "uuid": "5b0d3019-bbd2-430c-b123-e474a5176d27", "comment": "Malware payload", "value": "041314e7dec6ffaf2b608528a7996b49de481670895a8d5c35d7853b7b457f9c6af3e92e58283fb82438daa0f39d640f", "object_relation": "sha3-384", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574290, "uuid": "bbc00d40-fd16-4b50-b2c4-ae02414341ec", "value": "T1C501EB853F481C2D6AF9BF9EFC0C3D0AC282F2E451D095DA9521B156E4A3E0C437008D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574290, "uuid": "04e8e5bd-62ce-49b1-b7d3-170bc5d61b00", "value": "24:zWXrEU9C0Mspfp1lOxCy5U9C0Mspfp1l4JU9C0Mspfp1lcf:zgrEiCTs71lOxn5iCTs71l4JiCTs71lG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574290, "uuid": "d9813b73-22db-4023-a04f-caf7a69f9544", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574290, "uuid": "fc4802e5-d092-441a-85f9-4bdd68c4f591", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574290, "uuid": "3f3b9e95-dec5-4d2a-aa7e-d42bfdb7aaa2", "value": "Orlo.vst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04050919-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628581564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581564, "uuid": "dc8aac53-7bff-4368-85ba-d98c62f5130a", "comment": "Malware payload (Mirai)", "value": "3c8114ea8723fbad63205e1a3b34fa5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581564, "uuid": "acc9a311-1754-4100-a7ce-b6e907b4ddb1", "comment": "Malware payload (Mirai)", "value": "57283efe5e311d26bd0cce180c0265c27facbc47aa73a96bdd44ec991d1e9f6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581564, "uuid": "a951d604-ebe0-4fb7-bc00-9ffe84bc219c", "comment": "Malware payload (Mirai)", "value": "c92a2183ee9137e3eb8be70d22b3c59e254f01c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581564, "uuid": "1c4bec81-39d5-477f-ba0f-82d822c71d8b", "comment": "Malware payload (Mirai)", "value": "0bf493b4be11c6b25b09371e37fcc16ab9e7f32107b7cd5dca7067e94bc99503e3cfa1c635da9ae47abdd5b602fc4a82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581564, "uuid": "6e3e3b49-e25e-44d6-8e97-1c1e1871a148", "value": "T1C7030956B892ED5AC5E163F6FB1E52C937226354C2EF3203CC34DF217BCA0590E2A592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581564, "uuid": "0df1e98f-1f32-4d25-a64a-5ab399c9588a", "value": "768:WtFWHhesheYFIXepRH7QTa/DWlO+6o3LMxe3H5wb+J/+wp8iJZ7DftQGjMsPX:WtvsheYFWerIAIJFJ/f8k3fvjMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581564, "uuid": "ade37141-7d8c-4e57-8327-32735f04006d", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581564, "uuid": "790aa7ee-52aa-4e80-8761-3f477be740f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581564, "uuid": "d5ca71ef-6dda-46b5-b913-4705672161c0", "value": "SecuriteInfo.com.Malware.ELF-Script.Save.f0a75b0d.16285.24226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c840a37c-f9c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628590483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590483, "uuid": "25c3dbf7-01b1-4605-b747-0c937b0ef7da", "comment": "Malware payload (RedLineStealer)", "value": "362fdb2e05006cd91ae2d090179b4642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590483, "uuid": "e0c64a13-4d17-4ac6-9c2a-c3f82b4324bf", "comment": "Malware payload (RedLineStealer)", "value": "574e22b44f2b1a0af1e8344a2e674d62c246287fa41c9ee3725120bc329a8a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590483, "uuid": "cb74eab9-65bf-4024-8891-2caaccb849b8", "comment": "Malware payload (RedLineStealer)", "value": "b369e9475eea2e950112592944df5f2b88468fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590483, "uuid": "2e62e792-a8d1-4f36-8bc1-f55d3db46595", "comment": "Malware payload (RedLineStealer)", "value": "58f68d1d9553eae266067df54d3f6b27ed432c76c1f6240fe9a2add54136a68eb361efdc40d9836c4d40684fe01b6999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590483, "uuid": "40329028-072a-4245-8084-45d3e60bbb48", "value": "T1AA849D8575B4D50BC0AD01F284CB03B65A7084277882C9D0BAE3E76B5DEE7E07B1E5A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590483, "uuid": "c5f509e2-ff20-4d5d-8a4f-18066ca5c603", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590483, "uuid": "962043ea-45a4-4a25-941b-de25e6c86459", "value": "6144:YoJy3BwMMp7pjyp1UpjomkaKL0l7aRHeh/IpxA3q+/spImOc8ghwBmVea0lHC7aZ:5Lpj+Fmkz9ehQQ6sspImOc8owba0lRdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628590483, "uuid": "acdcb840-6dc1-4132-a122-27fd4c01d191", "value": 382640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628590483, "uuid": "4bf6d3c7-eeec-47ec-8fc7-0796647b44c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590483, "uuid": "fa1e6d16-0faa-4cee-b0d1-7e5e84140ce0", "value": "SetupCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd081bb-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560807, "uuid": "b9fa4df3-94f1-4d55-9e1f-80113ec1206a", "comment": "Malware payload (Gafgyt)", "value": "8bbe04e07ef22824434c9b1f1e6286cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560807, "uuid": "ce599703-dfa9-459e-8cda-2098a3997d81", "comment": "Malware payload (Gafgyt)", "value": "586887b9363f633f11be03166c3df21a3a56dc04e1d8fbc8afb01378e24361fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560807, "uuid": "27e2268e-55a7-43dd-a763-3b5ec71cec43", "comment": "Malware payload (Gafgyt)", "value": "d8af2f292f94e2c7fc4e42a34090f6698d06bf65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560807, "uuid": "d5b60471-596d-454b-99e2-0e0f36891b08", "comment": "Malware payload (Gafgyt)", "value": "9bc18ae5c0b9041f3fd8a54316399c248df3659bbec8084018e43771117e8408680dded2516f2a245479676aa558c672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560807, "uuid": "efa17aaf-0cbb-4fb7-860b-c715a9c86a67", "value": "T1D8833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560807, "uuid": "4b70dfd2-94e0-4df1-acd2-2f0d3bc3a5da", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LVWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yp2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560807, "uuid": "732ab5c1-67a0-4b60-bee7-2a3b2c3f607b", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560807, "uuid": "24513aa8-934e-41b0-aca8-b7ea9b51f526", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560807, "uuid": "e3c94c8e-3b07-4af9-a41f-f16d81a2b79d", "value": "8bbe04e07ef22824434c9b1f1e6286cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bee7c7-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628578188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578188, "uuid": "58a21f57-b26e-43f0-a7cd-cbc67ecafbee", "comment": "Malware payload (AveMariaRAT)", "value": "c40b55d536eb836167e84096f7350699", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578188, "uuid": "61ef354c-41ca-458c-9968-0214810f092a", "comment": "Malware payload (AveMariaRAT)", "value": "5885edc6cb2774fa0c0f1b1299347213efe8634ecffe330164bc868c5ef92553", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578188, "uuid": "b2b3c8a7-13da-4662-82b5-0000be8fa171", "comment": "Malware payload (AveMariaRAT)", "value": "53f1d6a972b3b981d53e5a2dd4cf7b2bb549bd74", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578188, "uuid": "a38bd98b-54d4-4cb3-bc85-7e6b2dda9a90", "comment": "Malware payload (AveMariaRAT)", "value": "2a64e9fc1aad1201666eef8518b950988d3e389d863c522cd0c04d1b9a0f675433251e97bf280ce36ea555547b547407", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578188, "uuid": "e9937a07-7897-4642-a0d0-efcf24093bfc", "value": "T1B864234FDA647EEBB31CACF344BC8A59A5FB439F21A80881F4D6B06E45D4C7325582C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578188, "uuid": "d08d2cf8-3d9d-42cc-bd49-bb85127c217b", "value": "6144:yQWazoB2R7yvAIhtUx2OTF5vrzfaIYKBilS70e8oZC9TvUcuJJKdPtt:HWazoBa7yvAIgMOT3ffn4S70e8aQImdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578188, "uuid": "1bf0366c-ba06-4e92-8b08-c7edc61d80e7", "value": 320419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578188, "uuid": "e71ad3aa-9cfb-4059-9de6-c3dabc3c88b3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578188, "uuid": "74fab400-b5fe-4ee9-b089-043d808e56ce", "value": "Document pdf.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d6589-f9c4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628590640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590640, "uuid": "b9e235d0-8416-400c-a982-d735d6a58e0f", "comment": "Malware payload (AgentTesla)", "value": "91f6896c42fcc7c1d5ffce7217ef41f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590640, "uuid": "50655017-59dd-4277-952b-47fd84b7cead", "comment": "Malware payload (AgentTesla)", "value": "5a0044006cc97a168cf5b4e2d249d040294d2a4eb683f2d54e91f7d849b23639", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590640, "uuid": "ebc25fb2-6464-419c-bac5-01453f6fe610", "comment": "Malware payload (AgentTesla)", "value": "6a4fcd63442f9d92b7eb3c92698279e50ff44889", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590640, "uuid": "004dc190-eab0-48ad-a68e-28f7004ba4b5", "comment": "Malware payload (AgentTesla)", "value": "be7d925ad2427a50dc8de3ac72b1a710a08aff074fe8197c508501135e4c005c85864d7e4346f371347721880f18cfe6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590640, "uuid": "7cd3a7fb-5704-4aad-be3c-92cf51b04c33", "value": "T19A65B5085E8FD6BFE65B11B8142C00DC50A6FD19C319BD7ABE0A7EB5B572EE5013B086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590640, "uuid": "8e1d2b94-181d-45d7-95dc-79f9b89e7b51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590640, "uuid": "22fd8182-be4a-4be5-b0ee-3af7ac9a55aa", "value": "24576:vIcbW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huW:AniecOvTESDPuNQuiNB/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628590640, "uuid": "ee8c75f7-f42d-46a6-a5af-9201fd07c49e", "value": 1431552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628590640, "uuid": "3c8dae4a-37d5-4080-9bc7-755646616cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590640, "uuid": "ab81b39d-25a2-4c3c-9c82-bd2ea30a18f0", "value": "invoice copys.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6666656d-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628583447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583447, "uuid": "d67c3210-f645-473d-b044-10a122c1c5f2", "comment": "Malware payload (Mirai)", "value": "7c07eafb2bba7d84d081f053b3594612", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583447, "uuid": "27dd7344-92a8-4a84-a77e-a120c5fdf3cb", "comment": "Malware payload (Mirai)", "value": "5aa39f140a6e8ce40cf45a665bb0fad29c742d00f6b8f14c1ba2d3f49c64f801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583447, "uuid": "a75767ee-f5f7-4f8b-923d-fc6127515746", "comment": "Malware payload (Mirai)", "value": "b894eb884597c9cda6161a226680ee7f71591f04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583447, "uuid": "2f5682a3-624c-48d2-8c27-218dd1d7eab8", "comment": "Malware payload (Mirai)", "value": "6e4ac9eb05b9268f726299f085cd601188580788bcf5843364026d14c316a2274887a76dfb5377675103a3d2f215efc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583447, "uuid": "42374e3f-f1cb-4b97-8596-b8a06d437ff1", "value": "T139735CC5E8015D7CF98BEABE85264B09ED2167005B930F2BA6ABFCD37CB31549D42D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583447, "uuid": "0e2e4a04-f8fd-4574-a1a1-7ee16081b830", "value": "1536:/4RcHufF86IEMUo8wm1zPTHJJ1SiPIWJmut2y8M8rh:/HuNtzPTY0xn2dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583447, "uuid": "6b412987-9a3e-423f-a7ae-c8e2ec6a5aac", "value": 79320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583447, "uuid": "8bf3965a-3a49-4653-ad26-16bdcf7b8286", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583447, "uuid": "8a18e9d0-fdad-403f-88db-066e89fe009d", "value": "7c07eafb2bba7d84d081f053b3594612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9ce821-f9c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628591269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591269, "uuid": "05a1d664-4b3e-403c-8e7e-3afa4891ee97", "comment": "Malware payload", "value": "a971cca9e7bf4dbad65f475f166ebb47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591269, "uuid": "56922b47-1d72-4cd5-a4f3-c735e94da13a", "comment": "Malware payload", "value": "5b2dc5cb82361a2048bb73df01c3cdf62f6f4444f7098eb3cd8702392ace6496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591269, "uuid": "5412d907-6609-48cb-8389-2af5fc5f1b86", "comment": "Malware payload", "value": "6543ec5eb5f8667dc447a7539fa109fcd7d78c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591269, "uuid": "95f26a81-3878-4048-ac62-694f12a4f76e", "comment": "Malware payload", "value": "e885749602e81d60ae9d21f51e85e31aa17d50e969075ca1ee42371f9afa06be72e8f96fde073f353ac9123955053609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591269, "uuid": "9a7d4fa3-5a81-4f0a-b55c-178074b2cab2", "value": "T197255C43FB55C561EB97427110B7E65581BF71308FB49ED3AB906A190AB82C0ED2F42F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591269, "uuid": "bab08678-a8db-451e-90d3-e3a5c4e9aa32", "value": "ae4197a0f891759eaef7252707a54fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591269, "uuid": "0fcef813-be5d-4c94-b6d0-801e0d2994b2", "value": "384:PEhQd4BzWFt/R98Lo07xNqj/a/C/ery7s62HG:v20t/R98c07xEahO7gHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628591269, "uuid": "52df1025-827c-480c-bede-7985517adff4", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628591269, "uuid": "7b5888dc-4992-45d0-9576-0d9c08dc0986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591269, "uuid": "59ed2688-c07a-4875-9dde-c68d3b18ab34", "value": "Vape Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01eb7cef-fa05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618497, "uuid": "c42e32cd-e294-49ee-acfe-75bd48edc248", "comment": "Malware payload (Mirai)", "value": "1cf24a5412c2aea752a91d4001e5e085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618497, "uuid": "51b7168b-72e7-45f1-b155-8fdc1121f99c", "comment": "Malware payload (Mirai)", "value": "5bf97b7471d978ce68e1a00fe73a1914bfbfb4820aa8878d484ace3daaf01fce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618497, "uuid": "f9c2ac62-111a-4409-9631-c8224858a10c", "comment": "Malware payload (Mirai)", "value": "e1f662dae5956967982e2174b38bc5000fb4e5d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618497, "uuid": "1fc940b4-8266-4193-83d3-939140f85954", "comment": "Malware payload (Mirai)", "value": "8809eafadc796508fa12cecf6c64df131e430f34cf33cac17a61cf0523cf2ac25c64abc89b1499eafcdbf63028a47575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618497, "uuid": "3ea3ee48-f6f8-4879-aa24-ed0f884e16e9", "value": "T173A3F80BAF600EB7D86FDD3305AD0B0635DC956722A93B75B574C928F61A50F0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618497, "uuid": "e4af8318-498f-4189-98b1-91855695ae1c", "value": "1536:1fxbGuuqCBQxgJkbx1NEcqpgxsZTPsWFSRYOWQgNg5ht:1fxSFTgxskYlu5ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618497, "uuid": "1c72d1d6-50cd-4d00-a255-32212c345fb1", "value": 105388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618497, "uuid": "62ee9419-4ce0-48b2-856d-f03355e45ef0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618497, "uuid": "bd4dbaa3-dff3-47ac-9d35-be3f3aa2353b", "value": "1cf24a5412c2aea752a91d4001e5e085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a56084e-f9c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1628592446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592446, "uuid": "1da15509-d13f-467a-9e36-64a500dcb9fa", "comment": "Malware payload (DiamondFox)", "value": "0d9f7ef9fc85315c134a06c483f0a694", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592446, "uuid": "cb8e4cfd-87bc-4a50-9c92-3fc56383949d", "comment": "Malware payload (DiamondFox)", "value": "5d0215d15cc28fd783808e7fe1103cff029e1a1caa1370057c6e5cf9c00d1b2a", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592446, "uuid": "9d0689ef-fa44-4713-a779-f8b21d4f16e4", "comment": "Malware payload (DiamondFox)", "value": "9a8f6eb079f6f1c8421a0f78bb5387b061d843b8", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592446, "uuid": "af49453d-4688-4a82-9fbe-764ffc580070", "comment": "Malware payload (DiamondFox)", "value": "b290e24110d994810d741f45447b712a52c70bb9ea55c8446a5a777a9c8f42e52ce3569a7821b3cdafc20df9778b5fae", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592446, "uuid": "9b95bee3-c186-44c2-8642-40430506cda6", "value": "T1B57523617BD184FAE58551315E4C6F72A2B9C39C0E320ADB77D4CB0E5F3C8A1C12AE69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592446, "uuid": "24deaf54-42ec-4c75-9317-4f55918c688b", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592446, "uuid": "b6fd0a29-5239-4f63-95b2-b8a7e2664d05", "value": "24576:xcVkKSGXCeomdCFDWHp/7F82Py2nNEPY/RQ5DsvLwcaBhdZIl9mTqUf+HDpFWndF:xcBNCpZgu2PyONEwJ84vLRaBtIl9mTiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628592446, "uuid": "903fd994-239d-40f8-802b-ba494e5bf330", "value": 1557610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628592446, "uuid": "55dc8530-dd09-4584-b525-e0e46e9b28e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592446, "uuid": "a45fef38-9297-4999-97d8-5fc832d237b9", "value": "7zS.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5db2c46-f96e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628553945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628553945, "uuid": "e4dff9ff-4ccc-4718-9d0a-04db2ef30d1c", "comment": "Malware payload (RedLineStealer)", "value": "4af838839ab7ce80d1ad21da6ced30fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628553945, "uuid": "fc6da2b6-e14e-4e41-8514-03c721bdd476", "comment": "Malware payload (RedLineStealer)", "value": "5d10fa7657f41f17d508c1dbb3f63b5b2ad6deea2f47e747b118345a56ab6cdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628553945, "uuid": "efe5b7c6-acc3-4e24-8fee-921993105363", "comment": "Malware payload (RedLineStealer)", "value": "5135c042645e5070b85e54f93087968178ee9acb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628553945, "uuid": "9b2a38c5-f0f7-4882-b268-d87dc725bbac", "comment": "Malware payload (RedLineStealer)", "value": "df28017ed9e4355d2866ebac12edb430cac83dfd968a72fc4dbe7e144797d87e4a0b1b14ae724d79a5fac0b6c27c1ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628553945, "uuid": "b1af27f7-1dc8-4e14-b050-02f1923b3d79", "value": "T13AE533420182C341C4E12EFAB6B6A769399EE7A72C8793A70FE12FD07F527D17519324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628553945, "uuid": "f2f5d236-0041-439d-9af6-861383ba7cda", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628553945, "uuid": "5bee9d20-3ae3-40b7-977f-966f6fbc08be", "value": "49152:Eg1ytK8qAnBo89r7EDXHbOst5eLXAjw8AbPKGdMGDFCH+cAvnYhiyRVtkDysuMvE:J1prUEHbOsKLmw8AbP3TFZcgAdVDMvON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628553945, "uuid": "362c890b-4dab-41e4-bf06-6d26aaaec4a4", "value": 3140303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628553945, "uuid": "f675f024-c367-47f0-a4a0-12301c74c451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628553945, "uuid": "c7f3f134-d498-4673-8af3-2f0c933fe11e", "value": "5D10FA7657F41F17D508C1DBB3F63B5B2AD6DEEA2F47E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b921857e-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628584016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584016, "uuid": "566621e0-bb8d-4c6e-9cc7-42a8dc492455", "comment": "Malware payload (Mirai)", "value": "61e2dc610cf3232f48ec5be7ef999e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584016, "uuid": "13a2b85c-c9a8-4646-be5d-32fcee544ebc", "comment": "Malware payload (Mirai)", "value": "5e31737b8cbc5b16c633f19717980da62a251563797ea125efeb92330c0e8014", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584016, "uuid": "26eeb043-7205-498c-b306-88e3679395a6", "comment": "Malware payload (Mirai)", "value": "cfb1638cafe17153c402382f09a2856786132a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584016, "uuid": "4779ac61-e2e6-4030-afed-6d94ec242f29", "comment": "Malware payload (Mirai)", "value": "7dca14fd42909dc2777c7e3456a680ac3ec1fe2c621edff8e6e823f67e7a21a39f5a8941b00eead030a37982a33aebb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584016, "uuid": "e69c9dc0-0c0c-4d47-ab98-b693eed2609a", "value": "T1E8A383097F610FF7E89FCC3749E92B05188D551A21A93B3AB934D818B78B65F25E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584016, "uuid": "2e0a3ffc-2b15-42c8-b0e6-b1d55629f844", "value": "1536:Ix5NF8lZEdfNH8Av0WOi/DAfzftRXJ+TshwD5OiEZZbYabx:IxHF8qfNHn0WhbAfzT8HOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628584016, "uuid": "8b0019cd-4c84-473d-905f-18cad36a8a5d", "value": 104884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628584016, "uuid": "d9247ed6-06af-4cd3-a528-6abe7a54d35c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584016, "uuid": "340ddc7b-fdbc-4d0b-9c7c-ea5149abfb20", "value": "61e2dc610cf3232f48ec5be7ef999e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab53534-f9d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628597708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597708, "uuid": "1bcf07d2-5f81-467a-b5af-5d6ae6ccafc7", "comment": "Malware payload (SnakeKeylogger)", "value": "cc2bcba266b5fa7bccaf7592df6c1837", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597708, "uuid": "98b707f7-a0e9-4495-99bb-8377b8ef2231", "comment": "Malware payload (SnakeKeylogger)", "value": "5e38e3d0a442ea94f31e31b53084f904ab45661dc50c9abec49c0a016dea64a4", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597708, "uuid": "4cb94e04-96e9-4035-97c9-d5a1c332ebfc", "comment": "Malware payload (SnakeKeylogger)", "value": "dbe4c6ea084ebbc0f2263fe8bd1814cb6f87c759", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597708, "uuid": "2120d589-e717-4669-9295-39635c27bf9a", "comment": "Malware payload (SnakeKeylogger)", "value": "31727a7b9fb6fdc8748036db10456180c81dd2c6510e640f4ea2dae5b2b678b2337fb74fcd01ed8bd9e208a857d6c166", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597708, "uuid": "38921063-e7a6-44a3-b3be-1f9aee141b7d", "value": "T1B755024B23805353C015EB3B5499A35306B5EEE5DBA2EED9788B353E1EE6301DE02B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597708, "uuid": "5b4ddfac-b81b-4f55-91d6-361c1098d5d7", "value": "12288:pZKKsn3qGaNHEyC9/oR9gy5FHK7zUXbmiE+JKTNAOhPI5l1yt8jKOhTNMxst1bHH:pZKKUPp9AR95yAivxtwlwdgMxGp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628597708, "uuid": "b6bcf212-8c5d-4113-ae14-df4956a43643", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628597708, "uuid": "218dcf32-17b1-46a8-8ac5-9e40b5f5f4f1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597708, "uuid": "51b41608-21bb-4ab4-a096-424c1aa29ffc", "value": "(RFQ) - ATTIQ - 10230-2413_TEMPORARY CONSTRUCTION FACILITIES.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690444d9-fa04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618241, "uuid": "4149e17b-eef4-4fcb-bd7a-fda847ef8896", "comment": "Malware payload (Mirai)", "value": "a55a3697d367110f67947f9cabcf4442", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618241, "uuid": "724c786c-ed88-4d7a-a558-3d6e9713df95", "comment": "Malware payload (Mirai)", "value": "622e96d2c6e35941cc57865e210379c9943952a6b595f5b6cb9430d1fb0de38f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618241, "uuid": "d97f4cb0-9023-43dd-9f25-8f38cb8088e9", "comment": "Malware payload (Mirai)", "value": "853e9eb5cd87c3554ce22b0d174b78a2edada46e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618241, "uuid": "38b7952f-8249-4621-aced-ebb83d9da163", "comment": "Malware payload (Mirai)", "value": "77b16cb23a2c998d27440d5ee3dacccdcae670468c200a7aba3edda51ccbc4aa62c0f2c71e0091be1c2e9294a76159f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618241, "uuid": "377b2b01-8edf-4408-884c-70c04772f6f8", "value": "T189F33B46E6408A13C1D61B76BBDF42453323DB65D3DB33069928ABF43F8379E0E26A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618241, "uuid": "f16674c3-9ba0-4774-a2a0-5422557846a5", "value": "3072:6ss0T4fWX9UjtV1HvISzhVIa2f0OMhVVFabGmYD5hGILSEgM/9QKlmnwjCDPqx/:Js0T4fWX9UjKihVIa2f3M7VFapi5hGIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618241, "uuid": "f0d22f89-a34d-4cc0-a99d-a909818f5c5b", "value": 170254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618241, "uuid": "24dda1e1-ed20-45e1-a05e-8c8bf0a8c327", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618241, "uuid": "7377da45-a7af-4ac7-9e8a-0fc914025b5d", "value": "a55a3697d367110f67947f9cabcf4442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1595accd-f9d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628597915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597915, "uuid": "6cf400db-c8d9-46b1-b302-846c67a40991", "comment": "Malware payload", "value": "ff11f18f4ce8621fbc3efa537a826bba", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597915, "uuid": "ed2d041a-3c16-4527-b8eb-6115b143c429", "comment": "Malware payload", "value": "62bdafadb015ac07e3225b149895b341e79a4d79e8d1737472c18b97560f2d3f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597915, "uuid": "a31d57bb-5a5e-4a5a-820b-e3ef16506b22", "comment": "Malware payload", "value": "9b5a20d17108a0ab21deab61de3d5cf08cdff76a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597915, "uuid": "ae250ada-5e45-4c99-9e30-bf0eef6b6bde", "comment": "Malware payload", "value": "d04ac1b340fc90b8f1c0bac17f0ef3ba91b0500c4ba8ec0cd18e9f8d33b495c598cf693cb3fc798b2bffe6f7b9bc730d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597915, "uuid": "ca8508ef-08b2-4384-a920-2665c6130f1e", "value": "T117F423135627B28AFB8B316E015CCF0DC5F6A0272191D9261B10DDA711EBEE93F6F494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597915, "uuid": "d1e68225-4c77-4858-8c11-6347559a2b6b", "value": "12288:mi2ekSXX7Efv12q76oWS5UZEeCu4jQtxYQ7IIASYHBRT1GC+SI6s2PYy/sllMkD:2ws2zo95qEtupxX7dVYHBzGcI6h7kllP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628597915, "uuid": "94c477d5-289a-4294-8ac1-6cbb30c1fece", "value": 784760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628597915, "uuid": "eab5e8fd-e35c-4ebc-a682-ae28d55debe7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597915, "uuid": "d37632cf-ac50-4ed6-ad2e-2decc7a8441a", "value": "Purchase Order 039124.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba9e237-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628608447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608447, "uuid": "d3c244e4-8e62-41c7-8424-7f32a09cf240", "comment": "Malware payload (ArkeiStealer)", "value": "b77fea1068099706f3f5d74f346ba334", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608447, "uuid": "d6981568-52db-490c-b793-620acf566bfb", "comment": "Malware payload (ArkeiStealer)", "value": "62c4f92778d0bd5831fad52da33914cd561ecefb6f5853925dc989bce3ffa3c9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608447, "uuid": "d850a275-7ba7-44eb-8200-94f1296402d1", "comment": "Malware payload (ArkeiStealer)", "value": "58c57f48c3a9338ced4b3cd174b191a9e38ed7c6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608447, "uuid": "cd987568-3964-4ee5-a130-7f99c7e7c8e7", "comment": "Malware payload (ArkeiStealer)", "value": "88b058899c7239d4431dae19fb97131fe13660cd708fd2ffbd955e2797f01bd1dd743aeff71f6e1a92f9e7f80771c199", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608447, "uuid": "17ee0f8c-54c8-4249-b9f8-b05095a600e5", "value": "T1B624AD3136D0F872F497453074ADCBA4F66AF8206B60065327A43F6F6EB32D0136A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608447, "uuid": "d3cbecae-a764-44e6-8395-defb5985c27b", "value": "e4e1e1e6e225074b287b0f65b50fbc7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608447, "uuid": "05c500e5-d6b1-49f8-83c4-53ee1c53920b", "value": "3072:7HzizXmEwgIMjnOL0J7bdTVnCm5W3O7YWnQdnCNeoBNTfC8IU:SwgIf4J3Z0p3xWWCIwY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608447, "uuid": "4c276040-ff30-445d-9b8e-5cf73e8d520d", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608447, "uuid": "0201d29c-b27f-498b-b48a-b7136de3c2af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608447, "uuid": "4a983e71-0a3d-4353-ab4d-f7c5577eb76a", "value": "b77fea1068099706f3f5d74f346ba334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb04004e-f9d0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628596071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596071, "uuid": "3a91aa94-34bb-408b-9f99-f42ba5513901", "comment": "Malware payload (DanaBot)", "value": "c0be1068b580bccf12f8f379abc80078", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596071, "uuid": "4aa7fb55-a5c1-4edb-8f9f-0e41d0e2b593", "comment": "Malware payload (DanaBot)", "value": "62dd176345d2aaac28ea5315c2aa216a4f74be4edf4d1591df918960cbafcb8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596071, "uuid": "f214be08-f920-4db2-a4d7-c58133cd4015", "comment": "Malware payload (DanaBot)", "value": "8d1ddcf6763848ec0259279ba91117e8f7333274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596071, "uuid": "47ea3d10-0199-4c05-9b33-248c8c377a5c", "comment": "Malware payload (DanaBot)", "value": "c512b1bfec3ea80f86e397e1edc4828c0b3431985ffab9081e28d2afc85d634a2409868388b3ac42223b4dc5ece2f75a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596071, "uuid": "6c8ec7f8-548e-4650-ae6f-6a65bd9ada5f", "value": "T12D45334B7781A472EC5C1C3180B26C171D33E962A521573FEB98FEAE6D704A69C04B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596071, "uuid": "7727f87d-596b-415b-a9b3-15eb1ed703f9", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596071, "uuid": "1fa540e3-2d73-4a4a-9440-621640c8656c", "value": "24576:No01ZB9xBF+di6U3atJliqn5hqiKEAovCNzURzZyqB:q01ZXFko3+DV5hnKEzvCNwZfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628596071, "uuid": "30b27124-d0c4-4aa5-98a5-3c80a7528b9b", "value": 1202766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628596071, "uuid": "4cff564a-357e-40fe-95ba-1dd1a420c466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596071, "uuid": "ea139701-8dfa-47e3-98ba-0c2ea3fa6bb5", "value": "c0be1068b580bccf12f8f379abc80078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe899bb-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628601260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601260, "uuid": "16ca22d3-34f2-4dd3-ac83-7e87290902c8", "comment": "Malware payload (Formbook)", "value": "a6eca2869a6af8b0d378b1339f238045", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601260, "uuid": "58c38041-b5fe-4540-b01e-b7ce4ef12e24", "comment": "Malware payload (Formbook)", "value": "6392e612cd5460c1bdfabe8f2fcf354e7fa91e08cb25d836c413d2758aa726bb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601260, "uuid": "99d52878-a43b-461d-83e8-7c76d1d637a5", "comment": "Malware payload (Formbook)", "value": "aa401265fdaf111c31c8d831a631c631e4bc9518", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601260, "uuid": "991045ee-7de6-444f-bba2-9f82e12174d2", "comment": "Malware payload (Formbook)", "value": "42971cb96b1953d829b8f786091ab9ebab7f324e9c682f2ab693560493ea83c8c8905e8ae75bc01b9682c4dca06a4795", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601260, "uuid": "bafb1c3a-e77d-4110-8fe1-073ab1e2fe54", "value": "T1C745127AD658AB0FF292D73600B26248555CFD675F53890363183BCBA532AB600AD37B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601260, "uuid": "2e10591c-00ef-4927-ad0b-d4fa3c55cedb", "value": "24576:zQqWS3EDziyk+mPOebaoIoJ0FhTBlciD3ff5435rC1ZQS/OWZ6P:zMSc9k+FebBIo2NlHX5435rC1ZQenZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601260, "uuid": "229d353b-9b10-428c-b2e2-1f30c7924824", "value": 1259752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601260, "uuid": "bc47b35d-a6fd-4212-b57a-cd9154a851ad", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601260, "uuid": "a18f4045-3f30-4745-8be3-4501370e4ec4", "value": "Transfer_form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a51429-f98c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1628566541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566541, "uuid": "0b48c1ba-13f7-47b8-844d-fbf7b44aac1d", "comment": "Malware payload (Adware.FileTour)", "value": "8a8e611e71aaee1408a9c5f65d9b9c29", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566541, "uuid": "e470789f-f621-485e-96de-90e550546af6", "comment": "Malware payload (Adware.FileTour)", "value": "6538789051b9ca8da7b851a2c775d0468d547d9fddb6a32433f4b1e5fe9a6ece", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566541, "uuid": "746366d0-c12f-4068-b06c-3cc481eea79b", "comment": "Malware payload (Adware.FileTour)", "value": "c26b6e337822a613793e6fde6a88743b298f9df6", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566541, "uuid": "e6ed7c1a-6957-45dc-a23f-5987de6e23a8", "comment": "Malware payload (Adware.FileTour)", "value": "2cc0bba9c2dfe61ae56d10666b944b9f1099a4d308f23cfb022e82acefef57374c4d4b8638cd7ced43c42bbf92a7787e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566541, "uuid": "eaedbd5f-a758-4abe-8cbf-991f85ffa9ea", "value": "T197E5339672F280F6E7D421748ECC2B32917CEB885E3099DBB724161F1F2CD6E452B652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566541, "uuid": "fd11686e-56ed-4f07-8782-669e0969fd52", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566541, "uuid": "90ef7de7-db02-4b2e-81b4-97c3ccf29400", "value": "98304:xht4ddHmJIftfZ+BPnR9V1+OTfuBEbCvLUBsKfQC7:xhedNmJIFfZeR9V1+OTftgLUCKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628566541, "uuid": "a95be8a0-7292-4f45-bcbc-0342d8c40447", "value": 3300149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628566541, "uuid": "a8cc42f3-07ca-4e3f-b30a-dd70bad07fbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566541, "uuid": "105b3b1d-3b29-442b-9cb0-bebb40c589ba", "value": "6538789051B9CA8DA7B851A2C775D0468D547D9FDDB6A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d9fe23-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561753, "uuid": "81a58d9d-7332-4a5c-9e41-3abc7305323a", "comment": "Malware payload (Gafgyt)", "value": "641db78b20d42334fe8c819103edc48b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561753, "uuid": "34033ed7-b32f-415b-9869-d7ea30b3e834", "comment": "Malware payload (Gafgyt)", "value": "66870840a8ee6c3cadcd857aeb4a3d8cdd0850253015bafdc16e8509dea5e078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561753, "uuid": "58b27563-f6f9-46e0-8807-e4ed57a5b3e0", "comment": "Malware payload (Gafgyt)", "value": "a41501a0aff1147fb1fb167d9ef8ae9b0633c15f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561753, "uuid": "486c2691-8c86-42ed-9849-0836e49a6d2e", "comment": "Malware payload (Gafgyt)", "value": "25512f2dbe19382ecfac61b829b463228fe13bc8343a790a783bd36f356ee6ed8d9c4bdbde4565c92970ba379af78a88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561753, "uuid": "b472c59f-816c-4752-bb44-37b60e37c066", "value": "T19CF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561753, "uuid": "c9d1de05-3ba4-4183-a139-3dc271604460", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBcYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/2YnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561753, "uuid": "174fe154-fb1a-4d0f-a2d1-3139cffcd50e", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561753, "uuid": "65a3941c-deb9-417d-9487-64553c136f6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561753, "uuid": "cb573c36-0f21-4459-babe-c7a4d103f721", "value": "641db78b20d42334fe8c819103edc48b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9583b48e-fa0f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628623040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623040, "uuid": "38a3756b-0cd9-4d4b-9436-379614d3e5dc", "comment": "Malware payload (Formbook)", "value": "941c74996c15ce27013b11268c01c7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623040, "uuid": "db7c1d63-58dd-41a9-9536-3f336b48fac0", "comment": "Malware payload (Formbook)", "value": "669785b03c7a0279a17e6ce7decb2a7dd19953dacf9ffe033211236274b2165e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623040, "uuid": "a96b47a4-db90-427e-9a49-083f429ef171", "comment": "Malware payload (Formbook)", "value": "8d1580d6404f48d2fb883d5d80012dfa26c78c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623040, "uuid": "fd5f441f-97ed-418c-b7d1-7c0649b11628", "comment": "Malware payload (Formbook)", "value": "54ee8deb2d0b9a1690f612bc972388b6c8b043bead7d4e710ce9b4ba5049eeddb6673049a6f2c29177aad86fa84a97fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623040, "uuid": "e8a2be14-509e-4175-885e-33491bc50c7c", "value": "T1F9F4022236A09741E03D17F8446BE1057BF5AD08A743E62D6C89F5AE9ABF58DC772303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623040, "uuid": "a9be5de7-d5d2-4723-97c4-6c2be3f53a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623040, "uuid": "b0d98037-46a8-49fe-b139-ec5f0470fb2f", "value": "12288:mPz0fHK7zm5YH7hTInMQc7ouUKcqDdja/gtRIWq+XG3/3p9D8:KzDq5YH79InMQcDVdqtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628623040, "uuid": "87952c55-a553-4783-9faf-b9f5c0c75319", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628623040, "uuid": "81235fc4-aa77-4b07-b4d4-02df73031a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623040, "uuid": "bf6b2868-682e-49a1-8f28-8e8cb7fd21fe", "value": "RFQ#0098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b421a9d-f9a8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628578704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578704, "uuid": "bc886df1-bfdc-4526-807d-1f651c036859", "comment": "Malware payload (SnakeKeylogger)", "value": "123b713c4b633da7d380443daaf0a459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578704, "uuid": "744084a1-3b4a-40ce-a5a2-1ad16cce27e2", "comment": "Malware payload (SnakeKeylogger)", "value": "66a27d30bd7d23c23948d0e34da3eb8b687c32ec5cb5ab030c68b8c60a4e1f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578704, "uuid": "9dbf12dc-2ed4-4409-a9b1-8976db9b6062", "comment": "Malware payload (SnakeKeylogger)", "value": "3d195ccf4c13c59c09e001bb65e890b7aed6cffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578704, "uuid": "f8bcd3a6-9884-46fd-93ab-55245242a49d", "comment": "Malware payload (SnakeKeylogger)", "value": "b9bd99e6409fc61667c90b79c2629ca3e5efba0d9d429361ed19f3ec9fa286732e836e8568247a71b7fa0b76eb445407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578704, "uuid": "9fb2a46d-a7e6-4aca-b1f6-9f1784f2afd3", "value": "T1EAF4024737805393C415AB3B18AD63930674EED5DBA1EAED7C82752E2DE6301CE12B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578704, "uuid": "602398e4-8487-4a35-b152-cf4214b527ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578704, "uuid": "f24957c8-a928-4301-93b9-9964b7e8bd34", "value": "12288:CfK6n3qGaNHEyC9/oR9gy5FHK7z10PYCHQpeJkoGUkK1uMlSRUpfP1r:CfK6Pp9AR95y5j+kOkKbyUpfPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578704, "uuid": "51251a86-be67-4a4b-864c-919349d60f43", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578704, "uuid": "2438c834-4ddd-4b42-996b-91a661afc84d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578704, "uuid": "551eadba-7430-4ff5-9b11-0accb6f49e09", "value": "S010891121011862 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581d780b-f9ca-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pitou)", "timestamp": 1628593302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593302, "uuid": "c38c2926-35e7-4070-8d89-3bb38238414f", "comment": "Malware payload (Pitou)", "value": "99a8becf9560cb3584930f0cdea99ecb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593302, "uuid": "b57e3cf3-e2b3-4807-90dc-ceccf31607ba", "comment": "Malware payload (Pitou)", "value": "66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593302, "uuid": "b88e5bb7-f445-407b-bf39-cec2ebec2a9c", "comment": "Malware payload (Pitou)", "value": "f35896ae3509d26794ea207c93a5ae2725ac1c53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593302, "uuid": "f7f0d8d0-0ba9-4388-af13-73198c57dd34", "comment": "Malware payload (Pitou)", "value": "d5eeef3517811d7222e76e06127184b9502d2efb7ed36b520f9fa442ae58a5fdd422a5f652064b65b9358445d2cf05d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593302, "uuid": "cbec7305-fe7c-4780-86fe-5127fa25a9dd", "value": "T1C9E4E130B660C034F9B711F845B6C3BDA92D7B729B3450CB92E41AEA57386E8AD31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593302, "uuid": "5af24c8c-ca3b-46e0-9211-d867e17f01b0", "value": "cc4caabe2c1a9c923331965c9764375d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593302, "uuid": "2be5416d-719d-4ea4-865d-6c7192e9378a", "value": "12288:5btUdicYVsqb/c7dJQx5BZtbZcUQ7URtFF3yZfBgAXaqxST:LolYVj59bZcRgtj3yZ5gAKqET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628593302, "uuid": "f162185c-a084-4050-9a80-1701162494e2", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628593302, "uuid": "aacb83f0-df36-42da-be10-d08627b59e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593302, "uuid": "18292c1c-ad3f-4a07-a95e-b2829b09f706", "value": "99a8becf9560cb3584930f0cdea99ecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e0fdaf-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628576489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576489, "uuid": "4329de77-bb1c-479f-b569-31a5b51c45e2", "comment": "Malware payload", "value": "442e555300c8fc9f23d2541b50cd5683", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576489, "uuid": "c45a5ae9-6747-4ca2-b84c-2e057d276155", "comment": "Malware payload", "value": "670e6cfe8ffded59575d5770f5685f2be005bd4352a9687b860282d4258a4cf7", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576489, "uuid": "59bb906e-2410-4c6e-aed3-77921cd18d3c", "comment": "Malware payload", "value": "44ced2fda2806966ac9cb596959d75c9da9929f6", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576489, "uuid": "1735fb6f-2c41-41e2-96bb-e76f149e3973", "comment": "Malware payload", "value": "7c9ba29573cd68a45ecadaa3e391ebcea8d827adb2c231ea6df0fbac90a804a0869d9f4dfc6613e592ac48257d2e9c2a", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576489, "uuid": "cc60a5c8-a6da-4a2c-99a9-75b6ae57b395", "value": "T148029E85A8B95B58CF61CA7ECD26056662B87329DED4365BA84433222E1D2D7072323F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576489, "uuid": "6fdf1d99-0fe7-46dc-a9e0-b83fc8b42cd5", "value": "192:37XqP0xBeu5hmFQyusRsvYU9Trh2Uk+YNW8TGbN6u4mbGAnyT6R:3m0xBeOhKQzvZP2B+Ys8TGbAWyeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576489, "uuid": "3a026826-1f17-44cd-a803-71c0d7cd88bf", "value": 9004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576489, "uuid": "e4f79cdb-00dc-40db-bf6b-fd68c69169bf", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576489, "uuid": "06bd1b34-af0c-4f4b-ab96-cccc01b58ff9", "value": "13,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d535f7-fa05-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628618667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618667, "uuid": "51ed19eb-4551-4ee4-810f-342eeaf204c8", "comment": "Malware payload", "value": "affad5f1f2bb721ffa379734707c90d1", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618667, "uuid": "6ada1506-1ea3-4bdf-82b2-28cf232dc847", "comment": "Malware payload", "value": "674a6abd8d4314c44139247217940e129f69caa84dc029dbe5f0bb55c5bdd3f0", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618667, "uuid": "fd6619dd-3318-4c2d-afa3-3a08ee434b4e", "comment": "Malware payload", "value": "df71b4a4ddec5b4b5ad89abfee9262c97fe9203b", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618667, "uuid": "8741b559-1033-4df4-985a-13ba39bc0c6e", "comment": "Malware payload", "value": "f08457fccc09ea584ee867a766659a119b9ab417adb41f7d56a32f665e4d164cf967da234bc35b0c701510fee71bd950", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618667, "uuid": "acd0729c-7af6-47c6-81ff-2d89d98987da", "value": "T1D3E173A265C658002EA59F9437CE2FE8D3AFFF50036FE5C50995BBA0AC4445C39F25B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618667, "uuid": "84707a95-dcab-4fc8-a55c-2dfd2f9eb22c", "value": "192:hhey2otwugjnio+NfK678bEYm8m0WfcPLZzn3zngcEzLjz8g:hheyJ6urotEYm8m0WfcPLZzn3zng1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618667, "uuid": "06ba1648-3587-45d3-a1e8-b5d259e3eef9", "value": 7211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618667, "uuid": "f5d1924f-ccbe-4469-90b4-8c7454c31373", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618667, "uuid": "f5fa585c-34b9-4dc1-96ab-19e830efc589", "value": "02-3704.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab33420-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628583642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "8cb3966a-b18c-4695-a667-a01833af8080", "comment": "Malware payload (Gozi)", "value": "c27e15e92fc6401b37346e1356b358d6", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "6abf4cdf-f855-4f8f-b908-f882ac9d0ee2", "comment": "Malware payload (Gozi)", "value": "67732ee8ba81cdd4855f6a208525ba600dcb5b3ace68f9befb9a81fb47d2adfd", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "ab02448a-5944-493f-aede-9dec5d5dfb9e", "comment": "Malware payload (Gozi)", "value": "75c8f1ac28f660285d0a03e020807fce0b5f6da4", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "1f4926cd-a402-4429-8f87-516cca811c3e", "comment": "Malware payload (Gozi)", "value": "5bfd515823e25579e71b1f2a4428d2ce704907153af40fe354bb91fa1103feb0ff6c6ce886be341c8ec5015eac7d1b0d", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "8ec8bfad-5829-4fe1-9e73-c67cc0f90a9d", "value": "T19DE31C776601DA8BE60B32348F83B9852229EC01BDF58F333114B36DD87E6644D5AE76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "7e228835-63f2-4373-b92d-7040c89d8620", "value": "3072:BwlYkEIuPm3fNRZmbaoFhZhR0cixIHm0DWsr5b4DdC45PV:alYkEIuPm3fNRZmbaoFhZhR0cixIHm0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583642, "uuid": "008e3117-6b36-4e39-a480-f363063820bd", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583642, "uuid": "b5e3cc1b-5c33-4521-8713-3d05c9642a3d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "abebb06f-151f-4c0d-b10a-eb6a3690d80c", "value": "sample20210810-01.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668d6c71-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628583877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583877, "uuid": "95e736aa-1195-4434-b48f-1c5038e68b80", "comment": "Malware payload (Gozi)", "value": "07684da40ad79495b5db6ddcf723bd8e", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583877, "uuid": "54a58244-fac6-4681-aec6-971b04d75097", "comment": "Malware payload (Gozi)", "value": "683f12747c11016669f9a7413b8975c615f39d2d530b1825eff8a36479e303ff", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583877, "uuid": "149d07d7-0054-4180-9206-e5b8f248f7f9", "comment": "Malware payload (Gozi)", "value": "7a7b3294628bd170ae0ca85ec533be7e0d409053", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583877, "uuid": "331f3fcb-9d08-4e71-a269-2daf5530d107", "comment": "Malware payload (Gozi)", "value": "42b177c91242c9fddd94eaa3dc7d81f3e5829fc80027cf2ce5550b14b06533e3dd44391b86aa6135fe5b9eb5796cc7c4", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583877, "uuid": "ccc05ba6-763e-48d0-8400-eb15390fca85", "value": "T1F7C48D163559AD36C1E362320B46A145635E30B42B3451CF37FC7AAE2FA55E33A3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583877, "uuid": "38095b36-1436-454a-86a5-755e74cca2a0", "value": "495dbada16b5f25b6891e0b1f202ae2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583877, "uuid": "b1193ac4-92cf-4792-87e8-6b4456e6906e", "value": "12288:1fIK0Xnn2SAXZUgKPLWg4+cLeWNTOg2d1yrvF:J4XnnzAX+zPqzLL3l2jyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583877, "uuid": "3cc769f1-d4c3-4cd9-93b7-3d351b828b7d", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583877, "uuid": "21ae1635-9e4c-4129-989f-62e613991094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583877, "uuid": "a18d0289-b5bd-418b-b456-22f724e3b009", "value": "611237846402f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38855a36-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628581652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581652, "uuid": "f4e835e6-673b-46e2-b743-f0e402af03df", "comment": "Malware payload", "value": "213f16aaa665e0884b9f310d9e6e13df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581652, "uuid": "25cc619f-0d68-4b6f-82a1-b4c7f1fabb97", "comment": "Malware payload", "value": "68c29343b0fa9e57ab0f2d096ed94fb9801e610b3b1edc1039f237ac2b647015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581652, "uuid": "d62df096-8a75-4f74-a69e-32847c19e1d4", "comment": "Malware payload", "value": "23013869d0c20deb9b2f5efc3807b5d8740afa98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581652, "uuid": "f2301c5a-7dc2-40f3-833a-3ffe7c844716", "comment": "Malware payload", "value": "109b06587675c83312d54b4a91597157334525b83082d3198d2345731ee7c3b2fffd3056aea9b0741d2acc1e4f3b585b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581652, "uuid": "acb17b1c-ef2a-4f5d-8b3f-7d6cb426050e", "value": "T17194813439FE501AF273EFB59AE475E69A6FB6733703A45D209103870623A42DD8253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581652, "uuid": "84460658-63d5-422f-b57f-c25ba8e6a028", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581652, "uuid": "22d98e95-7746-416e-92ce-39a2cdaa63ca", "value": "12288:i2T3BB5FzuuyAUsSqLH2xo1pXYAxc0gWpjkgc+yyTwx:i2Twi/5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581652, "uuid": "8a5bfc18-9f30-412e-b588-3f3411d4fd79", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581652, "uuid": "099d93b7-30de-4e39-8d41-e656cc75c2c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581652, "uuid": "8ab7c4ac-42bf-4bd1-8e74-b0d721915058", "value": "Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dabeaba-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628600532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600532, "uuid": "2b46c723-2c11-46f9-8bc0-e5f5655ec674", "comment": "Malware payload (Formbook)", "value": "15dd0af6a94ff8295c72a83ef9bd359a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600532, "uuid": "8040f913-5f74-4688-94da-40535d35cb68", "comment": "Malware payload (Formbook)", "value": "6931c7d4ab556ccd3cee7b8ddc9107f73551dd8cf5f293ec88d0ded26f52a9f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600532, "uuid": "865f0191-f069-45ee-8a4c-5d7f46721c63", "comment": "Malware payload (Formbook)", "value": "1e5236e252f24dbe1231cc18aecdfeac6b0d9a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600532, "uuid": "5dc45f66-5056-4d12-950f-4b1a23f9595a", "comment": "Malware payload (Formbook)", "value": "ce55c2471ff0a98b8c3756f66a9abe18064d9927aedac96ef5847aee84c0e5ca54f4f66dfc2ccff54a5e322e14df477c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600532, "uuid": "4a9e6675-97a9-400a-9d62-adee2eb75190", "value": "T1D635492439FA502AF173EFB54BE4749ADA6FBB733B07A45D1091038A4723A41DEC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600532, "uuid": "dddb2182-55b9-4ce8-a6c9-57c3d7d407be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600532, "uuid": "7871458d-59f5-4e08-bb7c-01f2aca3ca6c", "value": "12288:QWawIfK0f08jrRhidCMrC5Hr6LVEmBFt0ULGZbRSTHh3TS6np1I4vOODhgaPGNSi:HHTSmkWDZvSuPoT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600532, "uuid": "c46b7c12-a23e-403f-a48c-67b1dbfde0aa", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600532, "uuid": "d658fb7f-572e-48af-996d-fbe0c3c5bf38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600532, "uuid": "b96ac3e9-7618-4c26-8556-a9707345631c", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3a755e-f99c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628573446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573446, "uuid": "7134ccbb-abb5-47ea-a887-97d47a6a56a9", "comment": "Malware payload (Loki)", "value": "3bb34f3509f0dfe5e8bdb15a75cff5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573446, "uuid": "100bf761-203b-4ed1-b457-f677888360e1", "comment": "Malware payload (Loki)", "value": "6a7f81b90c5f5dac25eae27575dba58a5e92d7203ff81e75c169003f2ca688d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573446, "uuid": "b3d33834-ff49-422e-90ec-bf0e3b6077cf", "comment": "Malware payload (Loki)", "value": "624fbb38849ec52a0c168075b78f4bb75260d04d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573446, "uuid": "1081592f-33eb-4f96-9633-14e9f1dcd483", "comment": "Malware payload (Loki)", "value": "562db6dbca91fa4ea3a3a17f5349e3d0d5fda98dabc83281beaacf8e61bc62b5f7c15783874fad485401efe7423122e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573446, "uuid": "abd50aad-1eeb-4720-a4ce-4a787e50e21a", "value": "T1E1151988B540719EC81BCE3289748C3096117CBA572AD20F54DB3DABBE7E6D79E150E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573446, "uuid": "98ff5ccf-b016-45a1-9dda-89c51da19d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573446, "uuid": "90e78753-17d0-4ca0-978a-211414751cdd", "value": "12288:6Qnsb4pvG0W/9bLZ+tIgLKV1VTdiWk11jTWASiGDhGB3Xe8R4SwZo6zgDP6QGSL5:33ifZtgk1VTdizybiO1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628573446, "uuid": "526dec34-5a92-40fb-a1b8-044c05800cbb", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628573446, "uuid": "5f7f2046-cc73-40a4-956e-6b172184c338", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573446, "uuid": "ced98d64-07ad-410f-bb5c-c7e63db06a3b", "value": "?????????.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218b6c2d-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603089, "uuid": "39f7c449-7571-4067-9616-e15d5c9b5477", "comment": "Malware payload (Formbook)", "value": "100c39652e8851d14fdb2a4996fa1341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603089, "uuid": "960a1a5c-6f80-4e2f-8612-c7d241f29c0c", "comment": "Malware payload (Formbook)", "value": "6b1c4ecf03e71ee2c00deb9b82e805b16adaf5e01691f7d3fd1a972087c7481a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603089, "uuid": "7a960e94-c737-430e-9458-ceb3e4b13906", "comment": "Malware payload (Formbook)", "value": "17854a3512bb58e32a87654294b9d691fa2148fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603089, "uuid": "db63b4ab-f3a8-4396-9636-9864ac13edba", "comment": "Malware payload (Formbook)", "value": "465a08b35723ed000223518bc9e1c1d01feff506fab50df89241251737bea2b960ca8af9d9a996133ed03b441b369976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603089, "uuid": "82117f90-8280-4697-a50b-445b33ae31cc", "value": "T103D47E2171F07433C2564C7A5C0B0768E96BFF183D8960BEA9FA1D9C5F3A675243B292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603089, "uuid": "3fd86236-6e68-4fb1-b55a-e18405466eb3", "value": "6d1eb0ae82f87b168237eafad920be75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603089, "uuid": "37a72961-b447-4258-ae19-36648f228401", "value": "12288:dImxz1vULk5s9OY9oWKD6eoOLV2CH3eVgT4N:iwJULk29OYRKDHvp2U3e84N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603089, "uuid": "5229acee-d277-496e-9056-30023fed7c45", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603089, "uuid": "bbce8339-bde5-4356-8e0e-2358af44f240", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603089, "uuid": "8b675063-ae73-4db8-8db9-383478f71d4f", "value": "100c39652e8851d14fdb2a4996fa1341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66837163-f9dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628601486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601486, "uuid": "cf615d45-9287-4960-9acc-1c541895a5d1", "comment": "Malware payload", "value": "cf0672a35e06bddadeb3b913f4fb5b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601486, "uuid": "17df919b-b2ce-473b-a432-4d379f72c975", "comment": "Malware payload", "value": "6b1f2dd9cc3741ad3b921c8c1eb45de8809a0afd7c87d4a2604d4426b7e679e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601486, "uuid": "b58ed092-d0ec-49fc-afd5-1aecc412e1a4", "comment": "Malware payload", "value": "b8f5c5c1782e755762880679b82bb8c3ccdbd179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601486, "uuid": "17f433ab-f8d0-408c-9564-3d4df8f00e6e", "comment": "Malware payload", "value": "69cdfcf99d99a414db259bb66f9db81042705711de58f7cd34af5abb16b26e30b6400af04e16eebc51f48df5ff675929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601486, "uuid": "324b88cc-55ba-4786-8fb4-729f6a9ae7a3", "value": "T12D5412E0E624C95DE49756B6D661CD519800EEADF4F4A33F50AA70063AF37DB007BC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601486, "uuid": "a458383b-a8df-49db-bfe5-63f8373cc666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601486, "uuid": "aafd4f99-e307-4feb-8fc8-28907520bc65", "value": "6144:UcLX9P9waaaYmLp659g5re5J+7BOkFzSL7IcqhlbkEakwPbaMU:Vzw3NmLpe9gZe5Y7MCzSL7bqhyvOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601486, "uuid": "6a9d5220-9464-495f-8166-222d9e52533d", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601486, "uuid": "95346986-363a-4933-8166-221b8bf069e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601486, "uuid": "4f78ed20-cfb0-4796-8807-e5595bec6917", "value": "RFQ-TU4267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147f2efd-f986-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628563982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628563982, "uuid": "a982747e-9973-4444-a456-a177c90bf211", "comment": "Malware payload (Loki)", "value": "2d66bba47e64a05860e1cc38ef60eefe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628563982, "uuid": "fd8f6f6f-b2f8-43a6-9bdc-78c8dc7bbd74", "comment": "Malware payload (Loki)", "value": "6cf5cbdaa8b487a22ac7b489c5c7d8c57c43f7d505740ef10cac55a54bb1ff7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628563982, "uuid": "591bf595-69f2-4f92-a4a1-b71f0320483e", "comment": "Malware payload (Loki)", "value": "bc10bc47e665a9ceee5825ce0199ac1a24117695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628563982, "uuid": "edac3dd1-a813-47a0-947b-3ea6d278588a", "comment": "Malware payload (Loki)", "value": "7d6913e2d7e9cbc77ec3c9a44a3fe33e249ece615245bf9e5cec06825537bfc71172fbaf91e2aa1d4912bca26e3acf5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628563982, "uuid": "d905f5d0-262c-455c-af81-86249dc35496", "value": "T1C705CF11A3F9075AF9FBBB38A970015467F2F913A735D68E2E5540CD8971F80CAA2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628563982, "uuid": "b49ef145-e58e-4f03-a1c1-02b3f187b50f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628563982, "uuid": "62cc233d-0653-453b-837d-da887bce0838", "value": "12288:QcVwzt2NjFmzPSsaUppHYdGIr14pWvxx6wYSHHjK2XaVN5qhig2l:QewzMNjzsaIKGIr140bjjy5qgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628563982, "uuid": "b8a8015f-6503-4a0b-aa92-691126d6d939", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628563982, "uuid": "1f4b6ca7-ae3e-4995-9db4-d9604b8788a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628563982, "uuid": "ece8b8ad-3154-434d-997c-d0e864a236c3", "value": "2d66bba47e64a05860e1cc38ef60eefe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04f5ceb-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628601207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601207, "uuid": "f244d0c9-c420-467c-9ae1-5af22ab915e2", "comment": "Malware payload (AgentTesla)", "value": "d1683088475ef4670b55c3a1b3a68eb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601207, "uuid": "d7873086-2f75-4edc-9080-d73d3b610b49", "comment": "Malware payload (AgentTesla)", "value": "6e15e0a1a16d9b751be92a7407ff5412c3f32129f9d9ef5cf6ae4ea3e88edc7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601207, "uuid": "687ebf6c-9528-4da7-96da-fa83ed67b5b7", "comment": "Malware payload (AgentTesla)", "value": "24e980c93491f3ab64acd78e87eb8dfeda8d141e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601207, "uuid": "c9cce47a-1e80-464c-aac4-541c7585a88f", "comment": "Malware payload (AgentTesla)", "value": "3188490bc3506843ffaa3562b678d60b3c8231c3567dc6cae84605fb8371b7d2fb283425a282c694c8148c1c6990a353", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601207, "uuid": "56233719-e10e-4326-942d-200752ce99ae", "value": "T1B225C0D22740C153C8179A7A987AA7A35533E6DDDEA4995C3C82BF1F3DB3302841399B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601207, "uuid": "2da69092-c7ae-43fa-991e-9b1e9cc009e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601207, "uuid": "c003b8e9-bb4b-4ddb-9348-4d6dd8c5d14b", "value": "24576:z5mKPPp9AR95y9N0v1wEB+d1xU58KUk2XqAZ:NLPpKRyYv+EE/xK1xA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601207, "uuid": "2a9b08b8-6504-4b5b-8394-4fdf74cdc8e0", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601207, "uuid": "5ef9019b-90b0-4685-b55e-2ccb9d9f6a35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601207, "uuid": "024c37bf-b590-4c4d-96a9-abdacfb397f3", "value": "bill of lading and certificate of origin = container shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb61d67-f97d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560512, "uuid": "bca25021-87bf-423c-b29b-793c8d3eff47", "comment": "Malware payload (Gafgyt)", "value": "ba4a8b1f65ec3a6f10c04f39d745f6ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560512, "uuid": "751d3588-c07d-4716-b59f-934c7b1e45de", "comment": "Malware payload (Gafgyt)", "value": "6f3e49a944e8fb5839bfdbb177c8b9635c2aef95e39b16d9cce613245b879921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560512, "uuid": "4c27ec58-a0d5-47ae-ae07-393301709cd8", "comment": "Malware payload (Gafgyt)", "value": "a1e000209d8766234a6973f5d2a24d5e7ebf4e42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560512, "uuid": "cf586c46-2d9a-4164-ba96-3f3974c1888d", "comment": "Malware payload (Gafgyt)", "value": "78a644464dac802bce20110abd3600e1ccc85b032c05cd8335be015c883bcbb0143024a0d6d3be8933f9203baca48696", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560512, "uuid": "382d4df0-a1b5-4244-853f-00ea2777c907", "value": "T11EC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560512, "uuid": "0d41ab30-6a8f-4d12-88e5-acf6943a4c01", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epy+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Es+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560512, "uuid": "3980a83d-f697-42ac-9260-9d04b171f493", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560512, "uuid": "a93f0ddb-d204-437b-b16a-7cd13068dbff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560512, "uuid": "ab635643-d6d8-497c-b4f5-e0eb22a6aa12", "value": "ba4a8b1f65ec3a6f10c04f39d745f6ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10702527-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628576431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576431, "uuid": "4f9ff0cf-bb28-455b-8a70-5989fff78770", "comment": "Malware payload (AgentTesla)", "value": "2c076766a35b1a97015370e8fee3026f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576431, "uuid": "38804200-2e17-4cf5-9268-3b5c30be223e", "comment": "Malware payload (AgentTesla)", "value": "70f841604648c61ae31b68700b0b718414213ee8911324dea908d8001a805909", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576431, "uuid": "366e1bfa-4625-4696-9476-690e489d034c", "comment": "Malware payload (AgentTesla)", "value": "c83554fec8567876e70445221141076663d4d507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576431, "uuid": "404e0370-4acc-45c4-ae34-1f62ffaf563d", "comment": "Malware payload (AgentTesla)", "value": "56382f1e5f138747489c17c5869a42856b132980385984887f8968ffc1d7c04c2c032dfdcfd1ef06013f6df66be4df67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576431, "uuid": "58209fc7-ae32-4a1c-bddf-fcb649b0b14d", "value": "T1D7711B12B3740746EFD8A2FBD638FD1701DAB91389CB5480319EFA630B4A7716B26619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576431, "uuid": "a7469ccf-1b21-4a66-a309-6ad2393c32dc", "value": "96:5gqwp/81IbOCaPIorhPBe7WsJAjD6u/vr5NvL6NCrZz:5gq481qOCagEhQsNvxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576431, "uuid": "d831d047-6d82-49c9-8941-f9fccc5977da", "value": 3755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576431, "uuid": "b18ae2d0-4f56-4566-9637-bd1ded7abda2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576431, "uuid": "51d3a5bd-f790-41ad-92a7-a163a10b824c", "value": "ORDER_01921231.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4719b37c-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603152, "uuid": "1fc9a389-a1f5-4b18-affb-faa3cfa91a17", "comment": "Malware payload (Formbook)", "value": "78f998a3e27a3a76480d4bc25cd37286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603152, "uuid": "d938eb34-77cb-40e4-beba-9c0771585e7d", "comment": "Malware payload (Formbook)", "value": "7209a5aa4814e2f82aace6de499f4da7911c19bf06f5e12fd302806ecc2a67bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603152, "uuid": "5115bb7d-b97c-47a4-8047-76bf4b62f29b", "comment": "Malware payload (Formbook)", "value": "07f330e5da999ce439450c5dbfa518fd5f754ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603152, "uuid": "da062309-9ded-4a49-b410-5349705e8f37", "comment": "Malware payload (Formbook)", "value": "abf0f92b4fcdb68c3682ad2935cb680e36d1dbaa6d79733837036785ec4a8a622ec62cbc6ad42c257e30c7aefd885eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603152, "uuid": "28237e2f-562b-46c3-ae4a-c5a326e8a24c", "value": "T10915AD2633F52BA7E0090C36C81B66A09BE28C676136F68A78DE36F54F70716065F54F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603152, "uuid": "0204da5c-6f02-4ec6-b413-0b6aa2d2f6ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603152, "uuid": "36ffc83c-7376-4bcd-ac31-733c0d421200", "value": "12288:OlV9bJky5TzU2ai6D3h0kaHHM7wD0Pu0sIPWfZ4OU8I3/sBIjL8DPH:OUaai6DbanhUHFrWccPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603152, "uuid": "d812ca22-7e13-4b1f-8e87-c48cfdf0a5b0", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603152, "uuid": "fd3c6b53-b702-4b7c-8564-d5fb2c6d26ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603152, "uuid": "b2b0039b-1c88-43b2-a52b-5ca0a0f4965b", "value": "78f998a3e27a3a76480d4bc25cd37286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2171cd-f9fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628614842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614842, "uuid": "19994433-2219-408e-b8d2-ba40fefc2b66", "comment": "Malware payload", "value": "0a2d3b918377119adc8535a929da95f6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614842, "uuid": "baa00648-fd20-47de-8ff1-96cddf8e90aa", "comment": "Malware payload", "value": "7297d4d1f00dedf4415276c297be6b01d73f6210473b6568a89b746913eb271c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614842, "uuid": "725bc3cc-ab3b-442f-b5b7-f9f897c0de70", "comment": "Malware payload", "value": "50d6bce28d05b8b0698768bfb4b254154a05d73e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614842, "uuid": "87d090f7-0327-46a0-8c1c-e8f11e0d2db6", "comment": "Malware payload", "value": "8df25591066eda75b157a7bdd63dfc95f5f0ae2fa3a1c0bf6b911d2196e57b2aa6aa0bbefb6cdefdf6a9ed65a2adf403", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614842, "uuid": "25387d11-d5c7-46bf-b5fd-b01e98b4662c", "value": "T1FED3029797C4186DF07BB9366AF9A3731BB15AC49691E3D328045024AD777A30F8CE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614842, "uuid": "1c675d52-d566-452c-8039-dcb702a3067c", "value": "3072:ZFAQNdWFrK63yzQ7MfuxSpShoVFEV07uLuIQ2XzXcvm:3NdWpK63yzQQeThN07ovQ2jsvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614842, "uuid": "c87e905e-e961-43fb-a314-09963d149ffa", "value": 136613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614842, "uuid": "3fe983fb-ec9d-45ec-bd02-9e094838475e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614842, "uuid": "5ceb1d68-10c1-4012-84bf-726e54e59db9", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a595bb-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628578055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578055, "uuid": "b8f44a69-f0e4-430e-afb1-b7c4464ba2bf", "comment": "Malware payload (RemcosRAT)", "value": "833a678f0ada8f1d49368c1c92a17434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578055, "uuid": "4e317fa3-ecd1-4e17-bd23-498688f9bfba", "comment": "Malware payload (RemcosRAT)", "value": "731c0512bedc3492b1501d827b68754665facbbd20a6ad71508c2a538f910968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578055, "uuid": "14a5718e-46a3-4bf8-aeb9-7c571d787d13", "comment": "Malware payload (RemcosRAT)", "value": "ad544ff7e7c039546e714aac67865af8e95171c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578055, "uuid": "8e11ba53-021b-43c7-b24f-5004e68d864c", "comment": "Malware payload (RemcosRAT)", "value": "c42e1ba6801b2952cf7fcb08f68d810ea453b0a62c389fdcfa1387e05678136e0d132a0962b60077dd42d660ee3efe79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578055, "uuid": "72d5f810-68d2-49ac-9fd3-8ada5075ab73", "value": "T18105D06237EC8A17E27937740570E26516F1BD853E31D24E6DD07CAB7BB6B808A60723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578055, "uuid": "811991da-e0ec-459b-b977-61e0ea2573fd", "value": "12288:zAOX8QIYDYK/XgjZwhqCnRKULb5Mhws1dqHK7zbzKboFr7F:8OQYDY9PQh5ls1dZLKboH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578055, "uuid": "0d9bb735-1727-4e6b-b428-148d852748e3", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578055, "uuid": "7934887c-b290-472b-b8c9-954d45a761f2", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578055, "uuid": "59283687-5ff2-4a89-baaa-a43bf3cde72c", "value": "Quote#78945_2234#.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d805658-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628603135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603135, "uuid": "473814e4-0435-486f-9248-1a0d2cad31fa", "comment": "Malware payload (AZORult)", "value": "fff2931f6150ad787d2bd6c951019d0b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603135, "uuid": "0310d1ec-fc79-4840-a4cd-859a0941346c", "comment": "Malware payload (AZORult)", "value": "7354ea0eb730895f532442c9ca41ef796f8a21a50a7602496ecb3b07b0cf5f6f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603135, "uuid": "4c7ea1d5-f54a-43ef-9027-b71214dcb22b", "comment": "Malware payload (AZORult)", "value": "4965e76ac25ec5a7b5d795090c9ad2bb51af8838", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603135, "uuid": "5a4ee21f-621a-4b89-846c-610adf48e663", "comment": "Malware payload (AZORult)", "value": "dbc7ef87efdb34f627fbca10c3eb5ccf9369432f4004b1027b1f7bfddd1ffeb441cbbf1191612671066abc79c9fb41c0", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603135, "uuid": "2e1703e6-88ef-4031-90a3-8f1c895778d5", "value": "T1F7F49D3B73D996EDCA749AFA441201834AD6D8162933E36F34ACF5DD19202254B3E8E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603135, "uuid": "5d201795-a5ce-42f9-a8a7-a80dcbd7f629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603135, "uuid": "e8557858-7af9-45f6-a096-0ee9a0a1a236", "value": "12288:J7LD6MzlvJdSwMzEq2edGvUrJEq/y6INX6LRgU7e9uptgzMYTmsNHM:FLDZ3rPe7Gq/wKgDugoYTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603135, "uuid": "3cc203a3-5b0e-448d-bd8b-7041b3638269", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603135, "uuid": "32574091-5c91-4f7f-83b4-c9443845c3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603135, "uuid": "0cc53a9b-cf05-473b-b330-14afc7a4bbf7", "value": "fff2931f6150ad787d2bd6c951019d0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ded86a-f9c6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628591744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591744, "uuid": "135d55e8-e824-4b82-bab7-01b94703f872", "comment": "Malware payload (AgentTesla)", "value": "072fd23e850ed1bdf47de9f150d39768", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591744, "uuid": "e196db56-6c1b-45ea-a2e0-8133c4df1718", "comment": "Malware payload (AgentTesla)", "value": "738591a82b9d9ff15497b1bffadf2fc20c50d53eac5237ffa40250cefe8a19af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591744, "uuid": "e7e86134-d45b-4550-a100-7f2b9a01949d", "comment": "Malware payload (AgentTesla)", "value": "8769ee877c1989ada8e67c1124c4ecc312628692", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591744, "uuid": "6b15dc13-5e28-49c6-a52c-50cebf54d45e", "comment": "Malware payload (AgentTesla)", "value": "bc90308448695a36a548de5d873e6b897a15459a5462f99bdc6db8832960e8ae2c92ea99dc1486e639ebfc236dbf68eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591744, "uuid": "337a8c33-6e4d-4535-b40c-7067cac99cf5", "value": "T1C355375DBDF47557F26B54BCB2C860E211A1BD0D8F18AEE7AD82F3EA016124AE137017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591744, "uuid": "815e3ee5-6826-4ff0-9172-5050580785f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591744, "uuid": "db14e684-7a20-4743-8829-2302cf3827fe", "value": "24576:Z+XgKH/mim4XUOdwmWGEQuiNB/eJ2eUfOKS04v:Z+Xg60PmWNQuiNB/eqfO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628591744, "uuid": "c53b97f1-27f1-487a-b08c-3c0ad96164e2", "value": 1370624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628591744, "uuid": "d761505e-fee4-470b-86a6-711bf617f8ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591744, "uuid": "4793a11e-12a9-4b90-8cfd-8d57241fdeab", "value": "HSBc20210216B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86ba7ab-f9c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628593007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593007, "uuid": "59549a4a-16b7-4ba4-9ce7-a5a6e728d1f1", "comment": "Malware payload", "value": "69c885675b1b98e2fbb3f0196a1df2d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593007, "uuid": "8ba30bcf-00b8-4fb4-bdcd-b1c868adaef1", "comment": "Malware payload", "value": "73bcd67ddecc7bf320a19bd5dbefdb36c097c3047959d67e0e3cc5e22f8b510b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593007, "uuid": "b113bb39-50d0-465e-b4dd-1edf4163ff56", "comment": "Malware payload", "value": "533fa79f3b20623ae1c6de3fded5fb54b145af6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593007, "uuid": "4615457e-b153-47ab-b11f-e67eb83fab5d", "comment": "Malware payload", "value": "28b086f9d21aa48740a08a2d06c5c8df2f4becc7371e0eb0b7661a4919430a06217001041d440eb4c25d4fe8d15a59d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593007, "uuid": "157f4880-1f1a-4074-ae29-2f65c1a766d5", "value": "T126D6238933E44199FE6BF037CA52C607C6B1B44A52778B6F01E05A766F337B1292E325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593007, "uuid": "cbcee666-caa7-4833-b19c-bd6217dab586", "value": "161c85364c462057ba28801ac1ad5404", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593007, "uuid": "889dcfbd-d79c-40fc-8221-2ef0f463d71e", "value": "393216:37zA7xS2nebJWqMV/qU0GrQwywChsdCu:rV268qMV/tPrYwChsdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628593007, "uuid": "4836ffb7-d93a-4719-8a53-ab0bbf3b7c7a", "value": 12815360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628593007, "uuid": "778acf8f-2347-4c30-9935-356ff95b1bde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593007, "uuid": "38172fa9-6cdb-4e4d-bb87-973cb0caefb6", "value": "cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3d7e70-f9d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pitou)", "timestamp": 1628599622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599622, "uuid": "4bd02e60-1e05-4fd0-a47e-b3624dba26ac", "comment": "Malware payload (Pitou)", "value": "d4ac8896ed3efaf5abb3dab20804f848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599622, "uuid": "a299fe15-1b15-4627-862e-45fa68e2618b", "comment": "Malware payload (Pitou)", "value": "7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599622, "uuid": "27dd437b-33b1-4b46-a954-1970f0f466ad", "comment": "Malware payload (Pitou)", "value": "6c6bd7607711bf14e2e7e922f75e0c175dad91d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599622, "uuid": "de87b0c9-721b-46e0-a034-f015459c8668", "comment": "Malware payload (Pitou)", "value": "9eab4dd540aa27a30bea70d7b355095032000917d5372496cbfea3df17d116d3b3361b32b885450efc81649183b6dc0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599622, "uuid": "2709e232-1bc7-4562-a2e4-ebb6d3b2479f", "value": "T1F3E4E130B790C030F4B701F855BA97BCB92E7AA2577451CF92D11AEE5B286E4AD30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599622, "uuid": "b76aadeb-08b2-4a0f-860c-e273f6360bbc", "value": "cc4caabe2c1a9c923331965c9764375d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599622, "uuid": "5cb1a135-7a24-4f25-84ed-51a66ce31eb6", "value": "12288:AVtBliBgddthoOzmmQ6SZCQNTJhFVANU4ViJ176sy:2HAgdeHxf7ANU4gfJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599622, "uuid": "de5eab48-2a99-4a02-8f7e-9bb76054848d", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599622, "uuid": "07677f9e-0c1d-4945-af85-77f17402adbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599622, "uuid": "fe127fc0-bd60-41a3-918f-6c51a0a10004", "value": "SecuriteInfo.com.Variant.Bulz.596109.8199.17580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e7e14d-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628586372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586372, "uuid": "1d0d3180-ee63-4198-8a0c-f4cc47c444a8", "comment": "Malware payload (RemcosRAT)", "value": "d516c57c54c6c65ff050e16e871e71e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586372, "uuid": "06e0c833-d1a5-449a-b43b-57fcb9070af7", "comment": "Malware payload (RemcosRAT)", "value": "74615bedcd52ff089b0ed9dede11c46cd27de39b0b52c309ad71175e79e53868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586372, "uuid": "3de8a104-5250-492e-9240-c7a86486d068", "comment": "Malware payload (RemcosRAT)", "value": "4ca54d94edec79b304a6b4d85e7d5d0dc87407ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586372, "uuid": "8f05a61b-bf21-4aff-8e2e-8a08c20d2b73", "comment": "Malware payload (RemcosRAT)", "value": "76ed50c067e28fbbb1620da459ae59ffcc742903f1810180c2f5c3702a1ede751dfcd6d636b07c43a4c310293711492e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586372, "uuid": "a896e2db-7c5b-450c-8411-b45d43c3f6b4", "value": "T1C6948C3F1154821BF57CD27C2968125BF268DFC2F0DDE996E8D73586CA72A0326C426E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586372, "uuid": "db37594a-8ca6-4d84-aff4-bbea7b186aa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586372, "uuid": "91937083-0736-4c53-be63-d98d8ea64a17", "value": "6144:IHbY645rq7qbvKZKgOxJY+zzqArh0VuWPzvgY+u3j+B8wsOcBtSoA:gtQTbCKDRaOhGzvdxT+BVsOcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586372, "uuid": "1dff0f65-08a0-4c25-9916-3b9baab36fb2", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586372, "uuid": "f1864ae0-47b9-4305-9190-0f589d0d813a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586372, "uuid": "666c1e4d-c434-4663-8d73-198fae05d642", "value": "PDA ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5993036e-f9fa-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628613920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613920, "uuid": "ac947fca-b14d-433a-be96-06ef4e16dfda", "comment": "Malware payload", "value": "6eee42c08d12b60bacb58f20d0173291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613920, "uuid": "33fbe306-8001-4040-bb21-0d4a9ff38b21", "comment": "Malware payload", "value": "761361dc57742e6c02418454dcc28c1185d3837f3bb2262a7977184218c1986a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613920, "uuid": "b9651065-7b28-477e-ad85-93c4b94398a8", "comment": "Malware payload", "value": "cee1a26c81eeada1a4ec8fde0400821ef974cf20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613920, "uuid": "18cb0f86-ee8d-4907-a81f-165868eba95d", "comment": "Malware payload", "value": "67afa9a0885e28e758ed68767412e6df8bfe513b4e0f742b5144a7f8e24f49e3b23612b00ce517905c2f4f5e539ea2a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613920, "uuid": "354b180a-e72b-4134-843c-fdea7bae8e0b", "value": "T1B7B21A0E3FA98856C5AC1B74C6B5965003B491470513EE2FCCC954CBAFB3BD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613920, "uuid": "b13ad406-a77f-460b-aa46-4a5e857519c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613920, "uuid": "50ad35a8-5746-42f0-ac65-d00ed1e5e06b", "value": "384:ZTQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZBM:ZE5yBVd7Rpcnud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628613920, "uuid": "52cb1e55-67a7-4362-83b4-bf424e7c422e", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628613920, "uuid": "11267fd2-4d05-4b31-850f-f8eabf8e3ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613920, "uuid": "4a1b00ca-8a7e-48ee-b3d7-8e0610bce26e", "value": "malwarebytes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e996c5a-fa07-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619378, "uuid": "dbab8f90-b36e-47d7-8a7f-931d3e7d7bc9", "comment": "Malware payload", "value": "eb1908d7a1de02c157de8f339b4aaffb", "object_relation": "md5", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619378, "uuid": "15d63f5d-3a13-4793-9c25-5636e02a122c", "comment": "Malware payload", "value": "765c2295b8b2c6e67caa072f5896701b8ef84b70f77d41578d4e181f9d6c665f", "object_relation": "sha256", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619378, "uuid": "b55550b6-95e3-4ce9-b9ca-cf121b51157b", "comment": "Malware payload", "value": "e4ce3b43e1d16472812f03f0b41c2bd796e09548", "object_relation": "sha1", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619378, "uuid": "ed546aa4-8176-445e-ab3b-ae61ead0d82b", "comment": "Malware payload", "value": "ef546cdc452902543777a1b98d2bb4a62a3d9c34c48d6e21f4544bf2566947a3687ebc3b926abcc39a3e0f4b0eb0fc9a", "object_relation": "sha3-384", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619378, "uuid": "8a4df3a4-da65-495a-a7c3-b278f2e138a5", "value": "T1BEF36B41725411D2EAAAC63596EF867B9FB1BC0227E0DBCF2250B21C5F73BD06932617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619378, "uuid": "8a3df3c0-6289-4175-8055-b9fb88d2fe77", "value": "1c787c0721693fe2dc6f1e09e0da27bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619378, "uuid": "7c285561-de30-4e8f-8327-84458f3f2631", "value": "1536:GCy696uVJTRyPFU1UqI+AsgfCMlTzURbti:2kJlyPKGP+iF0hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619378, "uuid": "ce043b8e-fac4-43f2-90ce-c1e63c2258eb", "value": 166080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619378, "uuid": "654d6050-03b6-4936-82de-cca3306ce05b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619378, "uuid": "61a1bd5a-4dfe-4b73-9c06-c088bba594ee", "value": "765c2295b8b2c6e67caa072f5896701b8ef84b70f77d41578d4e181f9d6c665f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55561722-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1628601028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601028, "uuid": "5844eef6-d0f4-43d0-ad1a-5f51b8ef67f4", "comment": "Malware payload (RevCodeRAT)", "value": "d39da4595ca51a748ac33447965d80e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601028, "uuid": "a7a983b7-281e-4056-9b63-cd1d12d37097", "comment": "Malware payload (RevCodeRAT)", "value": "77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601028, "uuid": "767e05c4-8d20-430d-9409-cb7f6eb7cf28", "comment": "Malware payload (RevCodeRAT)", "value": "e7e0ec21e7cb1d67c906169e6e039d4b29c423c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601028, "uuid": "35a828da-8a2c-48b4-86a9-89527020bbad", "comment": "Malware payload (RevCodeRAT)", "value": "3cb182768087c31c32b244281fa52818316957188ab3c6a02a95475e36aaa8286df5f12f322e2d2f95cbeef5f89cb883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601028, "uuid": "f64ae524-17bc-43bf-990f-b72f1d3e34b5", "value": "T1752512BD38599235C4FCDC783A1EB25B6AD3E2A1A31838137853A85C6CD5CC5D92ACDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601028, "uuid": "9d29ad7d-5bb1-40f8-9fc2-dc3bc15c2b8f", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601028, "uuid": "33cec4b7-d5c3-4218-8c78-9313d0d754f4", "value": "24576:0FsVd+29QFw53L5o3DVUYR35Xc32WBjshPQ:0FsqtFwaFi3JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601028, "uuid": "e33fa00d-ceb2-49c5-b047-8734929348e9", "value": 985692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601028, "uuid": "b5418de7-4733-4d79-b449-e0ad860487dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601028, "uuid": "19f8d87c-dfc4-4b85-a76b-534da2aacdbd", "value": "STATEMENT OF ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6c341f-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628578194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578194, "uuid": "d48eb433-ef77-4f38-87ac-37ba7aaa22ee", "comment": "Malware payload (AveMariaRAT)", "value": "cc0daacf60697dcf0298f3f199e183c2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578194, "uuid": "01464652-cc2f-40f6-bce1-709a677acd04", "comment": "Malware payload (AveMariaRAT)", "value": "77a59a5b47de563c3d363ca27bb9a99a5b3faf366af126afcc78042151016c87", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578194, "uuid": "d7a58a26-cad3-459a-b8d0-24dbf4c106db", "comment": "Malware payload (AveMariaRAT)", "value": "5dd3940b45f616a55420880c7dce8ee323869161", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578194, "uuid": "81cc8441-5220-41b6-b105-814537830dd2", "comment": "Malware payload (AveMariaRAT)", "value": "ddf0ea502ca7a9218d08514c9719c0af35909bb9ff20880b4572f7d2d3e37e89a990da5af619a45a31f4f3533715cf65", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578194, "uuid": "41afdc45-83f2-4d7c-a306-4418235f8d4a", "value": "T17574230EA658DE6BF25D477348F942054EBAA36F30260A88B5C2207ECFE3B710D257D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578194, "uuid": "a22e0997-a672-44d0-966f-c0bb1cff22cc", "value": "6144:rvMt6V/hdmkcyvAIFtUx2yTF5vdzfaiWKBilS70e8mZC9TbUcuJJCoED:jMtehrcyvAI8MyT3lfjyS70e84QEO1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578194, "uuid": "5a349103-3d4c-4566-88a1-cc6f9a85cfa3", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578194, "uuid": "44c4e657-7357-4c9e-92d2-326ba7a89559", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578194, "uuid": "d5c3b843-d088-4149-a985-647907019756", "value": "Document pdf.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25466c03-fa19-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628627147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627147, "uuid": "663c29e7-d1a1-4ba5-8948-c1821d5a2dfd", "comment": "Malware payload", "value": "53771109f84c37ef7a1181a3c2dbc35a", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627147, "uuid": "f950d12f-5082-451f-913a-17d3285f7014", "comment": "Malware payload", "value": "78e1c4d6b90d322bfaeafef7bc49999e73299f76945ea0e8d8e82f7bf4404703", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627147, "uuid": "32253640-4d1a-46d6-ba36-bb9167d68231", "comment": "Malware payload", "value": "126737f95885214b12dbd30a3929dca204f71103", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628627147, "uuid": "090d859e-aaef-4795-96e8-06706b625ed4", "comment": "Malware payload", "value": "96f99f5d5f9ff3f44ccaeee7704e8537a5d3859803cee7b8ba99c48a5680c229041c25b0497ea5adc16e84e8a9c5262a", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627147, "uuid": "5e26ada9-8107-453b-96c8-625232b8bc62", "value": "T12B161262AFA0C419F1438830F4078687B22A079B5512F55F166B587E29B7D601F3AEFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627147, "uuid": "efa0da72-0f5a-4405-8aa2-124464da3294", "value": "98304:3SsshveewCWgLItH+JEi+wFshD4PaNZqMknNQkcOP+tfHdg:cvIv9tZGPaDuNBP+FHdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628627147, "uuid": "a966fbd1-6ebc-4641-bdb3-46cce2c9f5e4", "value": 4041765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628627147, "uuid": "2c5400c8-83b3-4e61-a115-572a621e8d3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628627147, "uuid": "bc7366f2-a5a3-467c-9607-ee06cbd43fbc", "value": "Chrome557698.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7331111c-f99c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628573590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573590, "uuid": "7f948241-d978-43f7-a6ad-0283fdbc5ce8", "comment": "Malware payload (RedLineStealer)", "value": "e988d1994581870c6aac979f87ab2a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573590, "uuid": "fc99b551-3280-4222-9999-ff8c4d0df424", "comment": "Malware payload (RedLineStealer)", "value": "794833762b3a94a9b1e88ffb915352823b7192255aa7ac86bbe9f93a64395854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573590, "uuid": "4b227343-d6cf-405c-b4c9-e6a94bf84480", "comment": "Malware payload (RedLineStealer)", "value": "9462385861ccfd7ab001fd381ffb72991299bff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573590, "uuid": "24853493-1c15-4c66-a241-191d85b179f9", "comment": "Malware payload (RedLineStealer)", "value": "74083d30ceb6eba0178428f15efdf181cedfda8c10ffcd4773c19d51b742c9656c8ca3042e79b2ea92b0f47ec55500b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573590, "uuid": "4c73224e-f9ae-4bf2-981c-a68ebc7b7565", "value": "T10C77337171A0DAF0F17113338523756805F5E2FB6E0083692BECB7A2F756646B91B0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573590, "uuid": "bdb17c70-7826-4e62-bf3b-3df5ea5cdf67", "value": "2b914b6fd04316572d777593dc737715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573590, "uuid": "ef79d407-85af-4003-ada9-05fd214c996f", "value": "786432:C6scxHyYirF8OUBLTEjuFrzRtIRIHc8F/ZY2axBrJ6Sy6xlvbS/d:C/cFor2NauFrzRmS88Y2KVgSXxQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628573590, "uuid": "3e8f84a7-c66b-4a83-b4b0-01e7f04c2eca", "value": 34787887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628573590, "uuid": "5c3c0283-d767-4715-8870-fe219b919c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573590, "uuid": "43ea8667-b1b6-42eb-93df-69edfdcc986f", "value": "wechat-35355.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1e9753-f99c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628573825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573825, "uuid": "0d3f62b5-6c30-4314-a889-ebe0af68b863", "comment": "Malware payload", "value": "461ade40b800ae80a40985594e1ac236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RDPWrap", "colour": "#684D20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573825, "uuid": "fbad6444-80ac-4343-9902-767ff7e29e19", "comment": "Malware payload", "value": "798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RDPWrap", "colour": "#684D20", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573825, "uuid": "33e1745a-1aa7-493f-ac3a-7023d40a686c", "comment": "Malware payload", "value": "b3892eef846c044a2b0785d54a432b3e93a968c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RDPWrap", "colour": "#684D20", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573825, "uuid": "b67eef7f-e39e-4893-a446-d71d530c871f", "comment": "Malware payload", "value": "e4298fe9af4f94e7d98d7fc1731f39ff1b424bdc69091b6ccf5d6056cf1632e7f8927368339351dbcd452feb62983fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RDPWrap", "colour": "#684D20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573825, "uuid": "867fa7ac-f10b-4f16-82e3-44b84a0ab51a", "value": "T14EB35B4773A100BBD4A7D638CDA34A12D77A78864771AB4E1790459A9F337E09E3CB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573825, "uuid": "88c90ae7-719b-49e9-bbe1-8822f656e7c1", "value": "53a3dacee6717ddc12074523c645029b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573825, "uuid": "08ca6159-ad8f-4766-a2f2-2b8e77407942", "value": "3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628573825, "uuid": "f7babb74-9ef4-483a-a8c3-58d376af929a", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628573825, "uuid": "812524ee-8411-468b-ae1c-c00af97bb6ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573825, "uuid": "bccff092-2a80-4316-97de-c9c81db81620", "value": "rdpwrap.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edecfce-f9fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614278, "uuid": "76cf965f-d973-43b2-9aab-3ad1ace2f295", "comment": "Malware payload (Mirai)", "value": "713f4008d859dde7bbd7e5cd7f4944d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614278, "uuid": "85e6e010-863e-4226-b2fb-3400ecace269", "comment": "Malware payload (Mirai)", "value": "7c446b4b871db5108ee923862234d751e8fec28fccb753cee577bb76fcf6d919", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614278, "uuid": "a299723e-f5d6-4ff1-8e72-2c31a2b2e805", "comment": "Malware payload (Mirai)", "value": "1331b8fb0e9a7b54a338edf5dea5d8da9412b11a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614278, "uuid": "05fb741b-889d-413a-853c-289cfd9af2f5", "comment": "Malware payload (Mirai)", "value": "d4e5c3f6e13359d42f717ee6e5a5dbe30b4e9bd5cfc8be8f1765d02694442e6d60d4800331d6390a0cd67f72918412c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614278, "uuid": "58200c6a-57ee-4e75-99cd-be7315b6c5ec", "value": "T1C8F202BECEAC62B1E81831F6119CB6E7B7E7E073101BC3CA90C2569350F097055959DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614278, "uuid": "0730604a-f34c-4e63-a96a-167e9fbede14", "value": "768:VYHqB/qBkWsFibQH0M72mwFFcgNt+rU/YdD8IvI02+FnmxmhTca:eSCBfsEkNwFJN+DRH2+FnmxmJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614278, "uuid": "02e0f9f9-6c30-40c2-878d-46a30a77b4ab", "value": 36160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614278, "uuid": "f10a7dc9-5823-4889-bbd0-7c485cf11db7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614278, "uuid": "cf69f474-cbd9-489f-aa4e-b22c69dd169f", "value": "713f4008d859dde7bbd7e5cd7f4944d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713b66e9-f9e8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628606229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606229, "uuid": "c3e8eac8-df40-4044-b3f6-d6fbce01d567", "comment": "Malware payload (Loki)", "value": "2c513c65f7f72438cc02d1bbd86e4e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606229, "uuid": "f08c662b-9bcb-4a05-bfe4-d4f34b6b8de9", "comment": "Malware payload (Loki)", "value": "7c58072332e83901d512567fec2eecacc2d29015a7ffcb2ecc8381b97cb8c998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606229, "uuid": "a945600e-3fb1-4062-b820-e0aeaae59f7f", "comment": "Malware payload (Loki)", "value": "8749f479771479c4805e2d495b7fadb3e509e047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606229, "uuid": "a686aff0-2007-47bd-a26b-ece09f4a7303", "comment": "Malware payload (Loki)", "value": "320dea5a7f6d222c34c9e863ee4e06eeaa1712bb5d4e5e2645ef8e696f302ed60c9fb518e30f3e5dc966603a65fdea09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606229, "uuid": "5d3e5a49-3261-48fd-aee5-846423e52dfe", "value": "T17EE3517777D2E919D059D5B4367AC1BA9C11B87726860E033686DB0A80F03BFACF9E05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606229, "uuid": "99e009cf-caab-4484-8bab-01400755cae5", "value": "3d408f10776c7bc07e6509fa832af9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606229, "uuid": "0d87be57-7d48-4704-9346-75ec38167f3e", "value": "1536:d8YX1xRhdA1l1Uf1msyJIS5YPdby5mxlr1gbtV9DwJAM:jFLuv81JDuYle56ran5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606229, "uuid": "eeae9ee7-5feb-4a84-b6a0-0d16993e657a", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606229, "uuid": "d3a877de-187d-4f0c-be29-36047dfd3f6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606229, "uuid": "9b2641c1-ac2b-48a8-9810-47081c4bf286", "value": "239 - FERNANDEZ AURELIANO 10-08-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ce8466-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628603205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603205, "uuid": "29978142-ed9e-47a1-98be-47b4d9ce4761", "comment": "Malware payload (ArkeiStealer)", "value": "e468fbed089419bc835f951f1763acb5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603205, "uuid": "8c5ff2c9-6112-4a46-94ca-9ee5b283975a", "comment": "Malware payload (ArkeiStealer)", "value": "7c87f681db3f6b7f0337faae390896ef94e05390ad78a78f7ad20dc7e7808efd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603205, "uuid": "5903313a-2a22-430d-8656-7935d5ac5b64", "comment": "Malware payload (ArkeiStealer)", "value": "bb012af6cb9c806af4541a8aa38a3d9e5a97fca0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603205, "uuid": "f42d17d6-5b5a-4053-b79e-4e98c80a9a08", "comment": "Malware payload (ArkeiStealer)", "value": "005fbf6e5a781dc674106cf36c5c97237246fc8948f50cce505204c43a49198055d98d74f184543c010b871de4088275", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603205, "uuid": "53ac5216-8b20-4318-8479-9fd0efc9b104", "value": "T14C749E30ABA0C034F4B712F845BA93BDB92D3EA1573450CB52E516FE56386E4AD3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603205, "uuid": "1b65be0a-8dea-4355-898e-9923010a6d92", "value": "9e69c87bb37519c7f1f7d4ff41d9c1a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603205, "uuid": "c0efe0ad-c3b3-4dc7-8771-43bc879d08ef", "value": "6144:OESoD0ahrox3TlV+tkd1QkjKytCJHO8LsQy2/4fdi87CwDxgLDm:B0ahsJitkd1NKKCJ53p/4flNOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603205, "uuid": "4e107295-d5c7-40b5-ad9c-3d8cb4e9f6ba", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603205, "uuid": "73daed17-614d-4420-b6b1-b3403e25c701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603205, "uuid": "791ba63c-1ed4-488a-8be7-6bb7ee6386be", "value": "e468fbed089419bc835f951f1763acb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5723ec-f9c2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628589770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589770, "uuid": "78e60a36-b1f8-4067-af52-5940c1662882", "comment": "Malware payload (AgentTesla)", "value": "fa1cf337d1d5acc084248b115f985984", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589770, "uuid": "2e767d5d-4483-4ffd-832f-a4c23fc55c63", "comment": "Malware payload (AgentTesla)", "value": "7d65371ce1f6ca3aae8d83206cc3484b54722f3993e94a2339482a02b3d94be7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589770, "uuid": "253977d2-c89a-4840-a75e-d68bfc75abda", "comment": "Malware payload (AgentTesla)", "value": "31e946e66637e1471b3a1f1f167abbea960f8bf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589770, "uuid": "26a4e154-5a86-4b0e-98e5-65ad5c0bd4cf", "comment": "Malware payload (AgentTesla)", "value": "a8c330175cb23a46e34be635b03c5a70f32e1b39b546e225ddd2f4fccfa2f3d63902a352de058482691c78270e33a086", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589770, "uuid": "8579b5ac-de0a-488d-9e1c-9cd804f74cc9", "value": "T17445CFF05518BB17FC6B077C2032185113E6BC99E938DB9DFF6630A56E736872062E86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589770, "uuid": "ad38ce6c-23cb-456b-aa18-85d68a00f9ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589770, "uuid": "ea1f7faa-1d3c-46f6-94c7-7eaa3b461249", "value": "24576:4kOsBgo0q4wMvBmCmTOUd+L6kWXWHe7wfbK:4NoHMZmCm6Ud+zWXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628589770, "uuid": "311fcb3c-c4f2-45dc-a22d-9a2cd5048381", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628589770, "uuid": "f5401151-9726-44ee-80a0-7fe323dc0f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589770, "uuid": "a32a2dc0-7d17-4bd1-afad-8abc319316c3", "value": "VIETNAMESE HCU23123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bab9c5-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628585379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585379, "uuid": "0377b76e-c2ef-407b-86da-e502bfbc5a4d", "comment": "Malware payload (Mirai)", "value": "87e8dbcec28b43325de76d0e0a388a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585379, "uuid": "06e72203-6777-4950-b0a3-d840bdca2200", "comment": "Malware payload (Mirai)", "value": "7e0e82082e14aa464ede5dbaa9dbd60afd8644bf8bc61ea2ac4fe89d9474e8a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585379, "uuid": "be25929c-98ff-4c2a-b61d-cc57830b7ccf", "comment": "Malware payload (Mirai)", "value": "036fd5c3f944488f48498f8999573baf64232e55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585379, "uuid": "b8a8c189-933a-4ad0-ba1c-6214b54732dc", "comment": "Malware payload (Mirai)", "value": "5000145f466f8c245753d241c58a29c5e99f04ef1d5f6300d1859fe95d9b436dfdd4484911011468fc50156a69c8d163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585379, "uuid": "d4a65962-a5a5-4839-886b-8d6cafeae7e1", "value": "T17B836C21A97A2F26C1E0E53F12F74365B2E1574E3AE8C61E7C620E0FFF10A9065175B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585379, "uuid": "60363c51-4624-4079-88e6-85789f1cc958", "value": "1536:VhT/5UtCT3Ev/UzSEAMTTJCQTlTTFKFGUDuii:vOcGNSl7UDuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585379, "uuid": "789c5795-7219-4b78-8371-1d8bf9759d51", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585379, "uuid": "14d37635-41de-4c68-978c-03f55a26725d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585379, "uuid": "92f953d4-b79b-4764-b755-9719815bdb6c", "value": "87e8dbcec28b43325de76d0e0a388a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b301ca-f9d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628596415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596415, "uuid": "7191504b-2e95-42a0-8d86-af5a21459559", "comment": "Malware payload (AgentTesla)", "value": "d8f2f9b2ded20063940380a69bcab74d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596415, "uuid": "a66ad7d8-95ee-4994-9c4b-ccc1d2eb08be", "comment": "Malware payload (AgentTesla)", "value": "7e420720b244391d792e3267c376c7422e50cce052a7ddfcc4753781bda51af0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596415, "uuid": "3fc5e2dc-44b2-4c88-88f7-f12209dccbb0", "comment": "Malware payload (AgentTesla)", "value": "aa89a90ff6a1de4a91ab087a39af0746021bc5ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596415, "uuid": "dae21f23-06d8-43bc-a90f-1a5a44679321", "comment": "Malware payload (AgentTesla)", "value": "68897a46d4c235d5bae3458f17acc5cbb5fb290cbb426412552d8ee20c351e09c8c77b12aa395f0c2cd91ec59b45de89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596415, "uuid": "b1d1b464-960c-49c0-9847-0238c6a604a9", "value": "T1D5B4F21278140F6BC0B14BF889F3C130A2B69E5046BB93D6B9F97D16F7F6B902D96181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596415, "uuid": "bb1455a9-4e32-43d4-ac91-3391fe449f95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596415, "uuid": "9dc501c6-e673-415d-b0cc-ce21a4d73bb9", "value": "6144:BabH70FtOs3s4WJYIp2H3EP5CvZwvBUY9ykrLWcNbn6eL7g21xu4BQ75UZMO:Bu4FVs4WKIQXEhQoUEriaT6K7fgeZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628596415, "uuid": "376cf4da-8f45-41b8-82f2-8f7052277142", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628596415, "uuid": "e5bbf1c3-669a-4366-aee8-b1884fbcade3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596415, "uuid": "b1ff4192-20c7-416a-8d63-743af346c78d", "value": "SELMER TBN_VSL DETAILS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2268d972-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628583763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583763, "uuid": "0ab9db30-69e5-4f24-bcac-db16bbbc29f5", "comment": "Malware payload (Mirai)", "value": "e9827887679062e02458116c60055b18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583763, "uuid": "b3c68850-b22e-4712-9f05-e1415a78f474", "comment": "Malware payload (Mirai)", "value": "7f9b692a2d2e7bb45ee5b46d59240df88c510905f1c6160cf6b3fefa486d9f0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583763, "uuid": "7df6b241-81d9-447c-971d-4831cd10ae58", "comment": "Malware payload (Mirai)", "value": "46d6b4d364e7202e34700cc8dbce6f4a116d2ace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583763, "uuid": "b1ec97a5-6144-4aba-97b0-68e8abc3ff7c", "comment": "Malware payload (Mirai)", "value": "cb5d40797c592fba7110f8bea7b839f93565377a5b0641fe01c57e38f379a99e4faf24271023345f321d5dc9fbb6c553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583763, "uuid": "669d6eaa-8c43-4966-91c1-a32f96dd591a", "value": "T1CB63BFB1D0696ED4C9488338B4E58D391B13FA0596672EF19AC689EA1007DFCF61E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583763, "uuid": "9ad0ada9-067a-4dd4-b7bb-494b4cdc254c", "value": "1536:M3WandVJxNwtrqo/CBS/u89YLBE+yzJE3SYzAZ5D0C44:M3WYpxNutaBX8WE2/zK5D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583763, "uuid": "a7225520-12fa-45d1-ae76-66d3fd3e85c7", "value": 73292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583763, "uuid": "f9b48969-1d28-4559-b301-6dd4e5c824bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583763, "uuid": "9b80189a-ba03-481b-8cf2-a9b42ecb5743", "value": "e9827887679062e02458116c60055b18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc1d157-f9bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628586787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586787, "uuid": "d75d436c-e0cd-46b9-8e11-7e26201b3102", "comment": "Malware payload (Formbook)", "value": "5cdcec900819b181a01ea4c007995969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586787, "uuid": "7cc2175a-0002-484d-8e19-712e57932438", "comment": "Malware payload (Formbook)", "value": "7fd75617ee39e8ed51f7e118f0aa46b83916dbf0d1d769e088c3fca7a4c0014f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586787, "uuid": "483ec26d-a074-4d0d-acc7-997a6657ef00", "comment": "Malware payload (Formbook)", "value": "d71954224a3c986ac4a7f116d4067d98257cfbb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586787, "uuid": "96eaee71-ae47-4f83-9c17-3308346d110e", "comment": "Malware payload (Formbook)", "value": "4cca33fd172b8c44e795fc4638d2902767718265763a56e13a2defb6444a022d477d126a681365ff7f7399b52bc23111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586787, "uuid": "62153a74-37b4-4271-ba3b-f6f7d7593d0d", "value": "T1B52412B5A1D81AE8D1BF4C3506E172029ADD883C471FE2F3D06524736A7F8D1A67782E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586787, "uuid": "0e9be206-e24d-49c3-be3f-007398d4dbcc", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586787, "uuid": "f2ff5495-130c-478c-9883-143951deb22e", "value": "3072:1g10r0K/C7MAov2zdV2JE/0unArFJHJlrAlfidgVkmv058mZT6+upQkdO7:1q0rpsMA+krMBBJHJZdnrb6+uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586787, "uuid": "968b0232-76f5-4e40-a67b-6522542239da", "value": 229012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586787, "uuid": "3761b6e9-d25f-4001-902f-90cf513497e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586787, "uuid": "0c777640-eb36-4a8a-87a4-94d6400b3638", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cb370d-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628581775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581775, "uuid": "a760a5a1-2ec2-4c43-9bf4-06e2036c352c", "comment": "Malware payload (CoinMiner)", "value": "5490586072efbc28f7b0f3f66b6aac6d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581775, "uuid": "77f04102-d403-4c3f-911b-28de87e4fcbd", "comment": "Malware payload (CoinMiner)", "value": "808e7e7a8755a60d66951619ce4452b08145abbf0ebf935e6ae116a9a165e99e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581775, "uuid": "91067c01-fe72-422a-b59d-cb841a6ce034", "comment": "Malware payload (CoinMiner)", "value": "61535306e34ebdf2c662eb127e163dc5dc81db43", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581775, "uuid": "b0cd0316-4c78-49b4-a8f0-bae131d37593", "comment": "Malware payload (CoinMiner)", "value": "94a6930696bd8519824aa5ec64dc3c24115ecf20fa3521baef43399b2c8699ac73229b07ac8d2392d95f0119a6644ee4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581775, "uuid": "9e15fb7c-a2fe-4d77-8d86-29108b6b0ba3", "value": "T18E15024B27408393C415EB3B145D63920675EEE5DFA2EEE83986792E2DF6700CE06B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581775, "uuid": "bb9fa5d3-634d-4cc0-a468-07097c3f3647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581775, "uuid": "9118b114-451e-488a-b7c1-a5af0bec992a", "value": "24576:zTnKJPp9AR95ydrlNjQk/G/Sv2QAxlt7p6f+T709GN:kPpKRydrIk/G/S+LxT9c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581775, "uuid": "6c25bd39-8aab-4732-bdd0-6344749940fe", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581775, "uuid": "94e3a3c5-ede4-4846-a3c2-6728913d63cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581775, "uuid": "b2e38d4d-27db-4ea7-b164-6afe60115ee7", "value": "07.08.0260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64239d45-f9e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628605777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605777, "uuid": "be719f6d-fdb3-4c63-938d-b077f796b689", "comment": "Malware payload", "value": "4d8b47112db825735c6b6118ba40a74f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605777, "uuid": "6f191242-7c88-4d77-9445-752940e616a3", "comment": "Malware payload", "value": "80e62ed960bf36cb83936a6a3f3826327ece87a38efda3f62d5a90504f6ad415", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605777, "uuid": "65c4cd0a-acb4-4522-82b2-9db54280cad7", "comment": "Malware payload", "value": "68506127159e0992e6bf4fdbb09096dc13b7c81a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605777, "uuid": "80410632-6c1a-473f-bb54-d488479fd203", "comment": "Malware payload", "value": "014338a8e3540974e49f5f84aedd4725c22c69a89e973b68f5caa42276706b0da7d96167ea0bf8dc2a58def34ae15fd6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605777, "uuid": "48f0b187-8ef6-481b-9d30-d0196beec4b7", "value": "T1E703F844B291C617F26156794DD7C7EB3339BC0AAE01832B33947F0EBC796748A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605777, "uuid": "c21b9a56-38a7-4165-b0d2-2ae08a986644", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZlp:GJKCBcEVA8pt/AB6MI2Ur/lVlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605777, "uuid": "aa85ab02-aeae-410d-b349-5d7a36955a8e", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605777, "uuid": "3e8768ac-5f27-4eef-96bf-b050b9d6c5f4", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605777, "uuid": "353042ef-1ecb-4f7e-b8e8-bc847c6b70d0", "value": "4d8b47112db825735c6b6118ba40a74f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb42935-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628583756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583756, "uuid": "16799425-4386-4dcc-8ad6-8725a731eb9c", "comment": "Malware payload (Loki)", "value": "ae08b4c86b1327fc1c767e9a746b5b6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583756, "uuid": "5cb43a36-a021-4d8d-8345-46100af20549", "comment": "Malware payload (Loki)", "value": "80f5c8e7094a7fc305b06c743b8325a26f88da552e4b29dbf1f49fd970ffb6df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583756, "uuid": "81c156ba-1e63-4b85-aacc-b62f747584fd", "comment": "Malware payload (Loki)", "value": "944240fa99d1af4a412575e1f91d353a67348564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583756, "uuid": "af0b8028-54df-40e2-982c-6726da2b576a", "comment": "Malware payload (Loki)", "value": "956fbc848c69573c8e13ee404d6fc75b23a0f6c35f5dd51297c7fd7ca7ee30f75c55f190383489449b68ce5d8daaaf93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583756, "uuid": "09d1c417-98e3-4bce-a30b-38332beca2c0", "value": "T1F2F4E0657780EB8FC27F4EBAC8416800DBE0D6735607F7C73DE645D81A89A968733286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583756, "uuid": "cc9560ea-7a75-407a-aa3a-f4321dd9b1ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583756, "uuid": "be9f0d66-9f65-46ca-aca1-28e72fc7a290", "value": "12288:ccCyAG1e2GCW+LQaWWccDai+VtR55t4YEE07uJGI+dtxxS6lUjIlPnJtFQq9V33j:cG1es+GgVtR5LMAItflUjIlPnJtFQq9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583756, "uuid": "11dc81f3-a2f1-4f0b-b00c-95ecd9cbb687", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583756, "uuid": "c1ba45d8-3251-4b6c-bbbb-c8f683bc90f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583756, "uuid": "32a09372-de1d-4604-8962-510b3dc8031e", "value": "ae08b4c86b1327fc1c767e9a746b5b6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8409b12-f9b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586135, "uuid": "1b00b156-bcd1-4881-a186-04fcf47b134f", "comment": "Malware payload", "value": "b99a21c8d93449080854fbbefe422898", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586135, "uuid": "52578dee-b6a1-496e-a478-c3305cd4f6b0", "comment": "Malware payload", "value": "819500f6d820bffd4290b172eb84721eee9f4d3a5814d58a65d5a321ce3e51ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586135, "uuid": "4f63b861-dac9-4163-8c33-c00cbd43583d", "comment": "Malware payload", "value": "ced7bc6e0f1a15465e61cfec87aaef98bd999e15", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586135, "uuid": "cf1016f2-921e-4a2c-8f8d-dd72b83c1227", "comment": "Malware payload", "value": "a297a14f538c5a3be499bb169daf14571b844b3f989ffd70288fc4f4f7f3b5a60ccfb55eacbe4dc485267bbd98d09996", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IISpy", "colour": "#10838D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586135, "uuid": "2b7151bc-41cf-4d81-8d04-64334e29cd58", "value": "T146049E21B1C1C07AD56F1A755838E7729A3E6D200F70ACEB23D41E391F741E1BA35A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586135, "uuid": "83ad72fa-8a0d-4e9f-8d57-62defc70539d", "value": "ac0d43d17d05c8e5cdc2fd93d1e33ee9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586135, "uuid": "7aaf5a7e-68f5-42fa-b3d6-0205a2f2e444", "value": "3072:7/pEYN1p3lghdLyxqNyqE3Mm6GqyafS7ElA7q8MoEHevNuyLAJ6JZC9mNos3MiCo:vXi8xk4N6GqjSiSqBHsn4YOPiCr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586135, "uuid": "4a4814a6-0a19-4e88-8b0d-830b935b0234", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586135, "uuid": "c1f7b2f2-8181-4c61-9338-73697b1486c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586135, "uuid": "8395885c-8525-44c2-bdaf-9244fe00b697", "value": "819500f6d820bffd4290b172eb84721eee9f4d3a5814d58a65d5a321ce3e51ab.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63689af5-f9fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614795, "uuid": "9fbd6af0-af29-4058-adc9-9278638e2ea3", "comment": "Malware payload (Mirai)", "value": "3feee96cf6d7e5eb2ae2b51c5f602ac8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614795, "uuid": "3ce7c802-bb5f-4975-a412-c9e45c442439", "comment": "Malware payload (Mirai)", "value": "82e66639bfef7c73932ca363a67cb09a57c774ca21bf12591a84c9d73b30b8a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614795, "uuid": "4780d8bd-abac-4b86-9d92-317eeb8a2e1b", "comment": "Malware payload (Mirai)", "value": "d54ae115941ad1c2be7fb360aa5cd98cf53bf7b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614795, "uuid": "6db69b3f-3176-4356-a180-8ee4a9a3935b", "comment": "Malware payload (Mirai)", "value": "905d06f2696b2f7ed81bf994769381d757e78f8fac69086aaa2d203d1dc2a55f2a41639bf4d5d545703455b3525ac953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614795, "uuid": "5523f790-777c-4668-bf0e-96695d871688", "value": "T1D673BF71E02D6DA4C005037476E8DE390723A9C1D7427EB2ABE48676145BEADB618FFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614795, "uuid": "2f378a04-9a2c-416b-8e56-feaa8f44699e", "value": "1536:/aM3RiES3YWFjwqvmrXY8QnqqUl8Z+DMoZ+CbmJZIv0:/Zhipj3vmr3x3DMoZ+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614795, "uuid": "2b9af57a-fd55-4884-8a72-d34c31706f2e", "value": 79588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614795, "uuid": "01f92231-abce-4852-9f15-a8d93cbc2c4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614795, "uuid": "bcaf72ca-8927-4f6b-b639-8f7acb7386c1", "value": "3feee96cf6d7e5eb2ae2b51c5f602ac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9241df-f9fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614809, "uuid": "9ea52f4b-8546-4a95-93af-92e8f3e9112f", "comment": "Malware payload (Mirai)", "value": "41445aa60caae0ce06989005d2158f82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614809, "uuid": "e8201509-5dbe-43b4-b8b4-5091da58d905", "comment": "Malware payload (Mirai)", "value": "833f944e82b4d95d95f42c82e6fa01ea1f635b753338d8f88fcf1e8a9f6ae1df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614809, "uuid": "d2fc7d70-cd51-4b29-bd93-16cee3c6fbce", "comment": "Malware payload (Mirai)", "value": "035c0870ce17a1d11b98461d80e47ba960c59ec3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614809, "uuid": "4ca65480-d738-4499-b267-e6a7bc494230", "comment": "Malware payload (Mirai)", "value": "0271ebd6700cef0db6ba871647b78b69d09cc4f684d8483201e126b2a7fc23072970abf696a4f79b85c74db8123ab098", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614809, "uuid": "37cb6175-fb49-4140-b04d-89044493a111", "value": "T12B63027DF146A044B3C4F674B77DC8B7308D8323B17E0156A1CA5045DE0AABFB993A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614809, "uuid": "9359f981-99f6-4ad0-bbf7-cd3319930dac", "value": "1536:vVo7DPL4KwGpgLb1/YmEI0Kd1jy1D86ucvcrgS44LS0XCwjBaOr5wm9dqc:+LL4KhpSpgtUbjy1DAgSXL9aOrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614809, "uuid": "865da794-61cb-4694-98e7-2887f69cd365", "value": 68320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614809, "uuid": "6c790dd4-2fd2-4e69-8688-5d5edfefe16b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614809, "uuid": "a538a335-73a4-410e-b1d4-08f0fbf0777b", "value": "41445aa60caae0ce06989005d2158f82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a41907-fa04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618234, "uuid": "e6452870-d998-4a73-81c7-5f6fe80659ef", "comment": "Malware payload (Mirai)", "value": "c74dc42bbe440932db0f1d72a2353a02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618234, "uuid": "daf229ab-3a3c-4270-8ccd-3a6707eb3193", "comment": "Malware payload (Mirai)", "value": "838128b004b0a6fb943655bae105acc61b2d9370b705e2bdbec330bc514ed442", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618234, "uuid": "29a59ed0-4bc9-457c-a941-cda0b045f577", "comment": "Malware payload (Mirai)", "value": "9224e2a0b5e860d6ee3bf3c0658060308f7c2cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618234, "uuid": "1492aa93-c319-4f0d-9644-964555dd39b7", "comment": "Malware payload (Mirai)", "value": "6376fee3544d503226b1babd336bb8bb5f8e685e01c821aca8d1340a7fc98762f856b9121395725e35d4ff61f8c9e7eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618234, "uuid": "0f149a70-10fc-4283-a40c-ec727f78786c", "value": "T1DF533A8AD583EAB1DC110079646A6B61DF33E63BA876E9DBD7985C32DC01902E3077DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618234, "uuid": "d53607b2-7dcb-4ebc-bd7e-b26c3136d9ac", "value": "1536:rdZ2PuURL7ORsW38Iva/6pYPqexmtUffQfmX5hT:rdYuU0RD38ipnexl15h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618234, "uuid": "57af8bd8-f277-4a7d-98e3-d027de159b80", "value": 62596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618234, "uuid": "7106382e-44fe-4fd0-a16e-ae4f7f4906f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618234, "uuid": "4b0a2028-7642-454f-b4ed-190cf5cb541e", "value": "c74dc42bbe440932db0f1d72a2353a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf7a7f9-f9fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628615055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615055, "uuid": "5d39f988-1421-4574-91f3-ba64bf67de1c", "comment": "Malware payload (Mirai)", "value": "ba2f6130961a4be99c805b240256615d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615055, "uuid": "28b81042-9174-4aad-a7a6-48475b9ef154", "comment": "Malware payload (Mirai)", "value": "86027a517def0050a49e32d8af30aa74807884fe5ea621966eba55fea632da60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615055, "uuid": "74fb0365-3f01-4578-adb2-69aa466c4356", "comment": "Malware payload (Mirai)", "value": "a5d09d04191a1928a0db33f50c89e1e21fb92f06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615055, "uuid": "87bd7798-f1cb-4f06-833a-d2b7a99dd3ea", "comment": "Malware payload (Mirai)", "value": "efcad08ee085dbec5b54ced424a5030b34f5bb98d141b3cdac1eceadb3f3e7c19a79f8eff22467d02dcab07d02e87d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615055, "uuid": "e8e54318-2f16-4932-b005-497e79dc56b4", "value": "T1EF835DD9B801DE7DF44BD6BA411A4F1DAD20A3845B930F17B667FDE72CB20A8AD01D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615055, "uuid": "7ca78182-be6f-4e83-bfa0-ea23d7685adb", "value": "1536:o5I7LbN/mVyf71g/NTQ2M/2hrvGb+DGx8a5cIcH:yLVyf7ATQ7+hS+Kbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628615055, "uuid": "cc09b72f-d5eb-4cff-bfb7-dd4f33396b02", "value": 88604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628615055, "uuid": "c04dfa79-4613-495f-9c03-f6055560139e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615055, "uuid": "a8948980-9628-42e8-b001-df87f1c860d9", "value": "ba2f6130961a4be99c805b240256615d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939c4a2c-f9f3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611011, "uuid": "e7b1f746-6d6b-4447-8ba4-cee5e04cedf7", "comment": "Malware payload", "value": "409aa172dfc9fbd0bb65d73afcae12c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611011, "uuid": "fa2c65be-8d1c-4e1b-9e40-d624112a2036", "comment": "Malware payload", "value": "875d380488cb27c1c6fd9d4e875eba110b716f3d3bc702344a2d3665b8256f56", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611011, "uuid": "f899d962-d28b-4849-9896-62300455c260", "comment": "Malware payload", "value": "16625481b1732478b465d470acb7b364208913fc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611011, "uuid": "28da7202-d1d8-48d2-946c-031af375b0e9", "comment": "Malware payload", "value": "c136a15c733438103e24c22613357e8fe8741d7266ecd1522cd1e14c5dbaad3fdabc92b8d3f0fda5b99791430f2efc2c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611011, "uuid": "28e34057-9c36-4fd4-ae72-18d837999bbe", "value": "T11FD3018753F4346DD0BF5675561AA3321AB24BC4E6F9E3DB39008148ADB76A31F8CE09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611011, "uuid": "9e94a2bb-f299-48b0-895a-8fe70f137644", "value": "3072:ZGwAldQ6EsjZbga4fLRos0buLuIQ2XzXcvu7:ZGtysVEakos0bovQ2jsvu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611011, "uuid": "16617271-e322-4485-83d5-7e5b5f0467df", "value": 136615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611011, "uuid": "fc95bdf6-e59b-4ad4-9a5e-3d7debd59e39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611011, "uuid": "892717cc-bc88-4fce-b5cf-a1b3fc801077", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a57cdd5-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628608794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608794, "uuid": "11831f59-514c-4e65-ae77-908793956f0e", "comment": "Malware payload (AgentTesla)", "value": "24ff3dd5a2ac1de1089c99502fc4ec8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608794, "uuid": "04f5e06b-ab3b-4737-b619-65f3e694b4dc", "comment": "Malware payload (AgentTesla)", "value": "8778da97f8df97240343e32d0a55cf7672308fdd83324c17ca0b2e0fd972b756", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608794, "uuid": "1bc10cdf-8bd9-4f9c-abbd-3861c262a340", "comment": "Malware payload (AgentTesla)", "value": "0b358f3a61229702a312d5166d8b06dec01db6b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608794, "uuid": "15934fed-26ca-4916-9114-7c377df45bb2", "comment": "Malware payload (AgentTesla)", "value": "567e9fc6419fefe909fadf6089a76590141ab9bf6ced96892375ff0cd271bef34834c6fd9eb10ffb603b58890c5fb33d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608794, "uuid": "09d79be9-2ac1-4f3d-9844-f2c6bacf8b2e", "value": "T1D005010B33809393C416EB3B6899B35306B5EAD5DBA1EDA97981752E1DF7301CE02763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608794, "uuid": "11e79527-aead-4874-8dfc-b43cc733389c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608794, "uuid": "b6cb55d3-f6bf-46ae-8709-f5bde6a47889", "value": "24576:dmBWKlPp9AR95y04MjsLABV9bQi7DU3+zhsqWLtx:IPpKRy04MjsEnwOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608794, "uuid": "3025fb8c-a7bd-4316-955c-dcfed22edfc3", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608794, "uuid": "b7db78d3-5307-4fdb-a38b-99320ea47513", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608794, "uuid": "46a4e0dc-4c37-4290-a4a8-7ab31eeceb08", "value": "Buletin de transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d66332-f9fd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628615338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615338, "uuid": "b3ab0978-9cf7-4cfc-a259-353cc8a3fc21", "comment": "Malware payload (Mirai)", "value": "604dc2e749aec0f0ecedc25c5725d76a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615338, "uuid": "70d5b6b3-871b-448e-a9d3-95563d6f1114", "comment": "Malware payload (Mirai)", "value": "878471a22aebebc987bb81254a1d8b27c7026337b6b72f931b738e8055d3ad5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615338, "uuid": "8a15898c-78c8-4cb6-9607-3d519d9eeb83", "comment": "Malware payload (Mirai)", "value": "a5d67c0199f36a8793d247fde1782f9b7f577739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615338, "uuid": "48e20beb-67b0-4172-9648-7326bbba119e", "comment": "Malware payload (Mirai)", "value": "2cb1ed9b3b9290965333a690b21cb0d70a8a30f5bfc5eb399cda174386953da317abc69af7b266bd37ec4669a3e770a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615338, "uuid": "c662c32b-dad6-407f-88ba-e6b4e8b39ea7", "value": "T1E0F202E3F4697C95ED9C8EF43BB861A8272965CA31B416571A35DD471CF00CA3B278D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615338, "uuid": "a0d437b3-542b-4ed1-9ad6-60e85b292a9c", "value": "768:uSoITWggLmgowziQW0ITR1cE48vZXGjL2rZBgk6xhobMYC3zjj3:uTtowO70IzZBGxh2Cjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628615338, "uuid": "04322f10-e003-4b77-bdd3-2897b54f2a1e", "value": 37428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628615338, "uuid": "fb7f069a-39ba-4c7c-92b8-cd9aae4fd3a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615338, "uuid": "a7939806-e3ff-4466-9d36-c223d2bc63a1", "value": "604dc2e749aec0f0ecedc25c5725d76a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f416dd4-fa08-11eb-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1628620050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620050, "uuid": "ab5c3e85-6d1a-43c8-82b8-f6509b6e916d", "comment": "Malware payload (IcedID)", "value": "f9277abde34e8ed699515b920ce7352f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620050, "uuid": "2da45c90-6726-4b12-9513-b8458763cb18", "comment": "Malware payload (IcedID)", "value": "88ed555efa8022e77f66f753a17d03ce3c043cc84c6382aeaabb4b957a4871f1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620050, "uuid": "7579865d-3837-4170-9c26-fa387a22e3c8", "comment": "Malware payload (IcedID)", "value": "f9b90e40f1860d30ae6d8ea8c75ed0357b34c4a7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620050, "uuid": "c46ac3d7-8cd7-4b26-bce9-57f75371e019", "comment": "Malware payload (IcedID)", "value": "4030d06d94c4e3b32f4d8f67a217ec0694352272ec6396c69276de8d1ffe66ab66550be2c54f132b5ee63e16e8d04b5b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620050, "uuid": "6e5d5f05-18fb-42f0-a55b-5eb8fe77fd70", "value": "T1F8B30264D4D4492AD2D672382C43A2D09B93A29ED163CE1A3CDD50D6CA435BB2F98FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620050, "uuid": "e8076405-c97c-47ff-bd11-c29b8512a60c", "value": "3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZjaP:PLvB83+cySlVYmL66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628620050, "uuid": "534ca742-4c3d-498e-89dd-6c8f4d9ef4dc", "value": 114377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628620050, "uuid": "da03a9d5-2ff3-435e-92a3-b8a8416475bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620050, "uuid": "4439c37e-02d6-4858-96ff-ef63246bc380", "value": "88ed555efa8022e77f66f753a17d03ce3c043cc84c6382aeaabb4b957a4871f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9595152-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628560823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560823, "uuid": "27737811-3ed3-4772-92e6-d2dd6aa0c20a", "comment": "Malware payload (Mirai)", "value": "f473cb463c23991c38a97979defd362d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560823, "uuid": "4728a671-ce77-4ba4-8088-5f9a5b131146", "comment": "Malware payload (Mirai)", "value": "895e344f62ebbb88a6faeb97747c25fde10dfd65ff920a7883cbbe0263df03a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560823, "uuid": "84888364-3e10-47a3-98e4-544e8bd6600d", "comment": "Malware payload (Mirai)", "value": "d77ab4c4fcdaf6ea01ab2ecbc78bc0c8f8a76d06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560823, "uuid": "fa9a65b3-5987-4727-aa77-1fc1e25189e6", "comment": "Malware payload (Mirai)", "value": "bc375f2a3f45fa23ce8beee3f6610ecdb592784dd9178e84bbbb9246fba140d4a2bf045d12e899c6613a89c31f027bec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560823, "uuid": "9674cf69-54ee-4aa7-9227-9498b9213f2b", "value": "T17F534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560823, "uuid": "42da4e87-5b9d-4820-af3a-3bb643242e3d", "value": "1536:LE2dKd40y5tgh28qPPgN8l8MsINprfm7uCciPY:I2Sq3g6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560823, "uuid": "cdd46817-1390-4d87-81a0-a3fb7137a656", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560823, "uuid": "df63ee92-e879-4d1e-ab8a-4ed6e29aca70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560823, "uuid": "dd75c0d4-0433-4b14-b69d-0d2a3ea8e039", "value": "f473cb463c23991c38a97979defd362d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484f4809-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628578243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578243, "uuid": "e336d7cb-757a-4363-9942-e2dabd5075c7", "comment": "Malware payload (AveMariaRAT)", "value": "7f016dfa5e22a08510e0ec5f5358bb67", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578243, "uuid": "bc2ae2f6-197f-4bb3-b9d2-ee1c6147be9d", "comment": "Malware payload (AveMariaRAT)", "value": "8988632c1f151363dcf5508756084830f38659c4f12117e18dc273786b5d0fb1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578243, "uuid": "92d80250-b5e2-428d-bfc5-e18783379ef0", "comment": "Malware payload (AveMariaRAT)", "value": "d8d74e0421e5d43e7d4b7e91f3ed4f66881ee77e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578243, "uuid": "d19d5362-c262-4ec2-9485-5de23a6648a4", "comment": "Malware payload (AveMariaRAT)", "value": "0f5b98216b25394d7a575ad7cfd586713a68ad1ea5b5148d5688a44d008c453ab22f97d7ea8181f232a562668d626ee6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578243, "uuid": "104b1d99-4a22-422c-bfe7-dfb32a10240b", "value": "T12A64230EA658DE6BF26D477349F942054EBAA36F31260688B5C2207ECFE3B710D257D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578243, "uuid": "8065d584-335b-4f23-90de-6798f40355f0", "value": "6144:mvMt6V/hdmkcyvAIFtUx2yTF5vdzfaiWKBilS70e8mZC9TbUcuJJCoED:8MtehrcyvAI8MyT3lfjyS70e84QEO1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578243, "uuid": "149781fd-0908-44e6-b7a4-b15464a45d68", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578243, "uuid": "71626b04-fcfb-48bf-adb5-0fd58b1b32ae", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578243, "uuid": "3a5debf5-3e54-4c37-9183-782587766bdf", "value": "Document xlx.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b3fe5b-f9e3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628603906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603906, "uuid": "1515a9c7-e728-451f-9e7b-2ebe9953b8f1", "comment": "Malware payload", "value": "5d2f26af87f6b26d229b453e39990453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603906, "uuid": "d98099eb-cc77-4464-968b-b6bba8f4d5f6", "comment": "Malware payload", "value": "8b913be4ad9c7cfe1693982042217a9c7656a5acfff7c299f8d90d12dca63d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603906, "uuid": "88f41b76-15f8-4e89-bfc8-d1bdf7d437a2", "comment": "Malware payload", "value": "87154d24acd066b4fcc3b112487e67be52485d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603906, "uuid": "7b5d153d-b125-4980-85dd-4982873ccadb", "comment": "Malware payload", "value": "e326cf9b080f25942b56540a847ffe363118acfd7129fcb7c282a79edbc8bfed23c9eadd1f5135295708b1e6311e4a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603906, "uuid": "87148b9a-1a54-4e3c-9714-d1bc25026d23", "value": "T17D930931DA51D039C89750F806AE93BDB91D6AB1535820C7D3F66DF6A3383E8AC3149E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603906, "uuid": "36d6ffd3-4983-4058-bf88-78f9a4479844", "value": "1536:ZpNqEfVdjfh/Hl/ax31OXbQ8JJVvifDRUkkAvS6TuW:ZpNqqTJ/FCx31sbxJJsfDRNvSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603906, "uuid": "4a2acb55-2936-4689-bedd-ccad5fa0f8fc", "value": 95118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603906, "uuid": "80529d46-942b-41ce-a334-396eaee1bc39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603906, "uuid": "1ff3de31-e7ff-42f0-8764-061c736e4545", "value": "5d2f26af87f6b26d229b453e39990453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53373539-f98c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1628566665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566665, "uuid": "1b44599d-806a-4dad-8502-a41ca8067c5c", "comment": "Malware payload (Glupteba)", "value": "190df0ed733b7c6cec66ec57331c3f47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566665, "uuid": "08a9e385-8e24-4fc3-abd1-6163937b2df1", "comment": "Malware payload (Glupteba)", "value": "8bb0c75f554647d27173b3d8b2e63abba3670fb7972b6856cbca89f1eda96c6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566665, "uuid": "2e314a1e-24b7-46d6-b417-4470b0e06b63", "comment": "Malware payload (Glupteba)", "value": "3fabeb10c0f3249abeacecd2a8a8f75d5bdc04ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628566665, "uuid": "40b53822-40ad-4b42-88db-862c9b14eb86", "comment": "Malware payload (Glupteba)", "value": "0cc2f536b0a0b11155068ab480bdb672603359c0d38e6a50020c2d4784e6be8275c0fced07d3db9296d9968b8789595c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566665, "uuid": "bd3159ae-1f76-4134-b0c0-7ef5d62aef09", "value": "T17D263320F6A2C03AF4BF11F456789368383A3F608B2450CF92D529ED96646FADD7075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566665, "uuid": "8670c4d0-b97f-4fc8-9489-44c43bf1e697", "value": "6dacec1c54365d76351cf2216eab7641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566665, "uuid": "e1e2f6b1-4396-47d3-b919-d3691f27b595", "value": "98304:Bh00Ggu38pYDjm9fHTRWvAP9IAiz+qzqPaOoZ/Pc/:BhYgu2ZY8IAnjPa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628566665, "uuid": "edad6b24-bcd1-4770-83d6-629ecc873fc2", "value": 4735016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628566665, "uuid": "ae624120-b041-469d-89d6-2d543151334e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628566665, "uuid": "d7906f51-5da6-4aad-afb4-3017c058bebb", "value": "190df0ed733b7c6cec66ec57331c3f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f802f-f9d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628596463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596463, "uuid": "57b21cf8-b15a-4fd9-a90e-441dd011f301", "comment": "Malware payload (AgentTesla)", "value": "f3f82be036f861d4765d1c74c18ded02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596463, "uuid": "a5b9349a-d2d9-4b70-8ddc-1f6a3f3c8f1d", "comment": "Malware payload (AgentTesla)", "value": "8d056e0dde01bc53ddf67b57555644ae00cf78a440c1a5832b685bf48a89c56b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596463, "uuid": "47611fc3-695a-40e7-bace-126f9ed07812", "comment": "Malware payload (AgentTesla)", "value": "5d15b2bdace35719afdbe84cf9419eaa9f0713a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596463, "uuid": "1ae6e3f8-2b0c-4e73-89e2-de58cad711ae", "comment": "Malware payload (AgentTesla)", "value": "14ce022eec8eb873ab44b025ddfd560fdf886628b3ec2dfaa74a0a8f7dc66366f79885102ee27b12a891dfd8d44c4603", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596463, "uuid": "c30e0d78-984f-4e76-b847-341f93852921", "value": "T1FD22BFC49223B056E7E29C3C695129DFF33F8564AE3B18D718507A8CCB53586270E41F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596463, "uuid": "c8482156-4472-4b36-9b8c-6870754b0b5c", "value": "192:xrXP/0uG8tfsCuNxEOmfZIZEzi9p6meAfP8Pskv/BG9c0D/:dXPu8RsCuNi5fZIEO99ezvR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628596463, "uuid": "81e8e989-bcdb-4178-9e7c-4492f8135e38", "value": 10632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628596463, "uuid": "93dd50f1-831f-4644-9f97-305309c22d5a", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596463, "uuid": "d09fe01a-62d2-4ce6-8f11-4b6c8d0dddb4", "value": "scan20210805122905.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67e5351-fa05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618774, "uuid": "51257a2b-56c0-4251-9571-4538c803ddb7", "comment": "Malware payload (Mirai)", "value": "f8931b30dd9b6628f98844f4caa7b4cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618774, "uuid": "f88c03d1-b2c1-4b24-9af2-95e75f6ceabf", "comment": "Malware payload (Mirai)", "value": "8d1b0432e597d19f5a9474b30a3f8d312110514bb5519eecafc93176a014bf00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618774, "uuid": "3bad0f37-da6d-4e42-9ec8-8dfd7928beac", "comment": "Malware payload (Mirai)", "value": "5abd57effdfc797b2147d95e422f68951cc62ae4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618774, "uuid": "7315e68a-fa58-4361-9d5e-6cb5763d05a6", "comment": "Malware payload (Mirai)", "value": "6a4dcf43a6b71d9572cdfbbd3e54854666cfeed0b59694075d4576c6115527f7564de395f1a42503cc357912b26f626c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618774, "uuid": "6f05f6b7-9869-4af6-aec4-a2edd75d5cd4", "value": "T1B1932A86B8419B11C6C15577FE0F124E33138B7CE2DE33139E285B647B8796B0E3A989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618774, "uuid": "453af161-a4d0-4d02-983f-708d9573ad3b", "value": "1536:hYnOsMB0T4fWX9UjPVI4rLc1HyzyE4u7iAeiJIwicPAiZ/rRbRw8Cadg7Q5hY75x:psk0T4fWX9UjNo1HOb7jPAiZ/HSay7Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618774, "uuid": "e4b37299-5e9a-4c9c-8378-7e8543901956", "value": 95584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618774, "uuid": "827a4127-72df-46e6-814d-2a43006dc4c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618774, "uuid": "6bbfef2c-3507-457d-936e-3cb6344b9f76", "value": "f8931b30dd9b6628f98844f4caa7b4cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423f70ce-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628600566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600566, "uuid": "2e336ac4-e16d-4b7c-bd06-ed924ac35cc9", "comment": "Malware payload (AgentTesla)", "value": "5905bb54207bcbad09a79ac1b228287d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600566, "uuid": "979ae4cb-d758-444d-93b7-1e2579ba9263", "comment": "Malware payload (AgentTesla)", "value": "8da1066696aeab5cb8bfa44fdf59d246b51757eee8ea2b34618d1e75c54c99d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600566, "uuid": "65ee5636-c8c4-496c-9cbf-95c3d74e8d9e", "comment": "Malware payload (AgentTesla)", "value": "b85ea1fb73ca82326e74d7dd5d9e1f83ae37299d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600566, "uuid": "8b5c2343-4eee-495e-bd80-8d109e38f069", "comment": "Malware payload (AgentTesla)", "value": "8c7af87b5da9a42e1602f8d1023606c2f6d04df0577d36deb0b638b16a570a3b7c1fe6872ac6d307deff4b526452d2fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600566, "uuid": "df59527e-1813-4cac-8b22-c15e557eea1b", "value": "T14D15024F22405383C506EA3A1499B38702B9DED5AF91EED97CC2B93E1DE6740DE02797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600566, "uuid": "c3409754-5a3c-476e-99af-c099f99c6fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600566, "uuid": "1c96013c-1edf-4031-832d-888b90e64be0", "value": "24576:qAPp9AR95w0giWlq0CZ1siDrJwZuSUbqP:qAPpKRw0gFYb1si6ZpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600566, "uuid": "13b3fd38-c5e0-4015-9a55-a1301fb7b10e", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600566, "uuid": "d7308ea0-653f-4e4c-ad1f-0ce6206a6d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600566, "uuid": "c024a33c-beea-4bca-a752-af0bddc3864c", "value": "BL-INVOICE SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ec6b23-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561438, "uuid": "cc2ae934-8bd8-4bb3-a7e5-be88a4212e16", "comment": "Malware payload (Gafgyt)", "value": "f8bed352a093c71ac93016652e2a02c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561438, "uuid": "753cd923-f3f4-447f-b14c-9761b033d0fc", "comment": "Malware payload (Gafgyt)", "value": "8e988ff0e424d253189fd75b740e209aace791231e7e0ce3df3bdcdb8bcad426", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561438, "uuid": "730dcaf4-6f4e-4f16-8cb7-b4e4147adc16", "comment": "Malware payload (Gafgyt)", "value": "b8300868cba64c9515c2b47093aa4a632b93cf4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561438, "uuid": "9b4695a8-eb73-4024-9f31-4ab6d09a2271", "comment": "Malware payload (Gafgyt)", "value": "2e4e3effbacb54363fee510b600a8a20931566572532badd7a11688810f79ce747f1c7df3492a4451fc8535f8031eee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561438, "uuid": "395a7032-b764-48b6-9b9c-8751f52e946f", "value": "T1C4D31905F4514767C2D31379B68E4A5D3B321BE493CB33265A34AFB42FC279A1E29DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561438, "uuid": "9ba0a913-22ce-45d0-9672-e3c7fd280eca", "value": "3072:66LdGaAhDwVHWddQNIVFhrSGHhVAgzZmsQNYMQ/XYln:3LwaAhDwrIVFhrSGhZmsQNYFfYln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561438, "uuid": "813a52e6-4ad8-421f-af06-dfd9dd996c5f", "value": 140421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561438, "uuid": "fc56a1e6-0c74-4363-a609-d91ff8c91148", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561438, "uuid": "ca2b462b-ee98-413d-bd66-ed99189b44e5", "value": "f8bed352a093c71ac93016652e2a02c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d505b14-f9c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628591082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591082, "uuid": "ec8a7024-a051-4d09-9bef-bb807637ef7f", "comment": "Malware payload", "value": "e615703358f675841a1e419ff7ba717f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591082, "uuid": "d857b062-336d-435f-8f70-847e264c7c60", "comment": "Malware payload", "value": "8ef8c74c60388a8e9a022133bae1330a45d3878acb8ca358b84debd1c150e872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591082, "uuid": "f1cc6a2d-8a01-4d08-980c-4e61201d3e5d", "comment": "Malware payload", "value": "c85749e7100eff098069e682973cdfa03e736c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591082, "uuid": "4d0e2d3f-861a-423d-8411-87e24a86b664", "comment": "Malware payload", "value": "f51a1c399c590a056b33551d05895baa5e3c2d03bb30383b54439d9c9c9061c6b3f8f99f1fdbfe8e172be44185c64f7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591082, "uuid": "0c5e611a-70e7-434d-915b-ae4a7232ca36", "value": "T18A9612233A818C7EC63B3131510AB379A1A9BE309D3442D36B917E352A745D259FB62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591082, "uuid": "40c5cb0b-278c-42b0-bacb-0389a204f377", "value": "42043a389268832f98a6dd7ba7ff7493", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591082, "uuid": "30d8db57-a000-4c15-874d-7c8a93d0533f", "value": "196608:T8ou4bnvhCO1Ex+/4RLrLzskAPL1AV+49pgEXC89ylw:lZ8PLwl8PXC2ylw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628591082, "uuid": "a99a03e6-4003-4d58-a799-6da5f1fa78dd", "value": 9319224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628591082, "uuid": "3909b60d-6916-4e7f-b8ff-3d08f377ad43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591082, "uuid": "59521832-20bc-4535-bfa2-d822e12e7f6b", "value": "I3GSvcManager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a55534-fa11-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628623741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623741, "uuid": "1fc95486-3262-4966-baaa-e6a47c99a60d", "comment": "Malware payload", "value": "a2112d3c6b589061b7c97fc2df9ee154", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623741, "uuid": "ca4eee97-0af0-4ef8-8d21-07285299e0fc", "comment": "Malware payload", "value": "8f408002a2c7305f6eff6b076043660b1fc29e7dc265a9fff0421a86081b987a", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623741, "uuid": "da792b5e-b1e3-4429-91fd-aa1ff3de188e", "comment": "Malware payload", "value": "34e5b6a7785a08570a0aac4f12f64f8cff4d8274", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628623741, "uuid": "26a21c45-1e5f-452d-ae44-1c1e6b14d7fb", "comment": "Malware payload", "value": "ff8708c1c0a7e6cfdb88bef7a535b64a0399deafe78fef4759a37767b3c7df742f20810a6c62379c87c65f6c0057f6ce", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623741, "uuid": "b4ccc6b5-313c-4ca8-87b0-76e591ea2d19", "value": "T1EED53329D796C94DC83B857184566346B121282DEBC8F13F0A3D885B6D8BEC8CF56CED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623741, "uuid": "40b70960-8de5-4b92-99e6-d56e60098f25", "value": "49152:qLff3a3QVebJIOj+h3QsyGGf4Hel1QfaZCL2C9eIzQPC0T5KYH/Q5xKySEX:Wa3QV6tjwQ9bzAvRQa0T5DHI5EySEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628623741, "uuid": "0ecc2086-7e0e-4054-8bfd-32cbb5438fce", "value": 2981606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628623741, "uuid": "71e1d729-e144-4108-802d-241c402156aa", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628623741, "uuid": "3972408b-7933-44a3-8f9a-605224d013bd", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268b3d05-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603097, "uuid": "f1886b95-834c-4367-ab22-717bf466aad9", "comment": "Malware payload (Formbook)", "value": "85641d2dfcdec2026c1c861488f86c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603097, "uuid": "56e4460d-0f76-4cba-a49c-b462989e66c6", "comment": "Malware payload (Formbook)", "value": "8f493a908950607b487e105caa9b4e6f835d36063bcb61d19f450fb78a6db2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603097, "uuid": "9fba0304-8d4f-4898-aaaf-c85293f9d35d", "comment": "Malware payload (Formbook)", "value": "a10e141f74d3eb09b7dd554299bd23f0666ce3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603097, "uuid": "eb275c64-b5e9-400f-987f-f18d1a619609", "comment": "Malware payload (Formbook)", "value": "9ef05132daab38d19db39bf4f817c9f9bb3ec4ade68886d78b3bb5865c157d824f382d9f3bac638280e08f5b827ec012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603097, "uuid": "a114b9e3-7f05-4246-a965-9793d975046c", "value": "T102F4AE1B778077D3D3188E72D9071A8883E28D27B272F2FB24D47AD94E13716AA1F456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603097, "uuid": "6b1ed6b6-5d37-4890-af6f-0a64c33770f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603097, "uuid": "02301b5b-c22f-41e2-9fed-12ef02617b79", "value": "12288:r8u5zkvyBLnFGP+Inlb8uYhkOH7ywD0Pu0sIPWfZ4OU8I2vXSJ:wsk4XIlb853LUHFrOSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603097, "uuid": "bcdf92f7-e9be-49a5-9190-686fd5274b58", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603097, "uuid": "3e405a32-88b9-4e29-a2ee-12d12af69c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603097, "uuid": "064e634b-7972-40ae-943d-6083128cbde1", "value": "85641d2dfcdec2026c1c861488f86c1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd906a28-f9c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628590492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590492, "uuid": "6831a874-dbef-435c-8434-e3ce9b1eaac5", "comment": "Malware payload (RedLineStealer)", "value": "54263196f68701f4d74ecce284ebf501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590492, "uuid": "e785b09f-b038-450b-a8b3-76c29caa1f70", "comment": "Malware payload (RedLineStealer)", "value": "8f9d77e5b65e2263f81d3398d3cc6741752702021bb5aa6a2a716cf6f6e204d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590492, "uuid": "3abbeffb-b113-477e-a758-4d4e6ce0a14a", "comment": "Malware payload (RedLineStealer)", "value": "7432a4a4a57973d77ca7f65a2be4bb357efddc30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590492, "uuid": "3f48565f-f52e-45b9-ac19-0de3fa3f8704", "comment": "Malware payload (RedLineStealer)", "value": "6e7c3e716191eda257a96d61afeff64b9c9f24e984c352c9abbd53e17b63af86a73c08cd14910bb57b36f005ee977e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590492, "uuid": "e4971904-8075-442f-9f76-454f70c3f84f", "value": "T1A995C3DC9D5DD043FAF478F19C66D924A1EA2C69488BC44E2AF9722B5072BC3EC055CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590492, "uuid": "32de9542-a1bf-469c-ae22-4e7def941c62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590492, "uuid": "94fcbf07-5606-46d2-aefc-40455e347856", "value": "6144:mC9arWeXxjm79UQxyr7bUkxChx4ZfAb7nC0WEG05iTe1WT:r9arWY679oQkxChx4S95d1WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628590492, "uuid": "515006b1-7625-40a8-a2ea-54e731a18623", "value": 2010224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628590492, "uuid": "a2cc9783-5b0a-403e-be93-e78fdbeb3af8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590492, "uuid": "cc0c367a-b158-4d42-aaee-7664e75e6069", "value": "Minecraft_v4.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e677b16e-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628583662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583662, "uuid": "f7c380a0-1427-4b93-a25e-5b9879b590cf", "comment": "Malware payload (Loki)", "value": "fe66ecbd6fd8ab53daf22a4f759ba8fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583662, "uuid": "bfc313fd-c6ed-4f39-9c95-d6c316809746", "comment": "Malware payload (Loki)", "value": "8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583662, "uuid": "7ff9aecc-4f99-4ad4-948b-3ce013480ee4", "comment": "Malware payload (Loki)", "value": "73e04864d4c4d7d402c082c4a6cd9934dd9907cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583662, "uuid": "9a36763e-aba7-4841-8978-e3600a0e8d1a", "comment": "Malware payload (Loki)", "value": "df8ef5bf0af79a98e724b12a5d715dfa4d8cda8f0fd7e02d1b6208f352f794a7729ae82720004eadddd392770f3351ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583662, "uuid": "20333b15-1646-499e-89a3-7b3e74cbd061", "value": "T16F340201FE442DB7C63E68FCA3A8927CA2C9540463905EF362D587756E70AFCA7B6850", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583662, "uuid": "de228993-195c-4029-8024-b5978177dc36", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583662, "uuid": "9f9fb63d-b57f-4c50-9acf-968402025c30", "value": "3072:7KhRNLktPfWpUDQKsZo9vYCyQw4pa1AfLYPnEpDIEBtK9h1Wi8prbLdhnzcy2bx:76Nk2pFF+pgup4AfLYPPawfW1pbnz8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583662, "uuid": "f1362dd5-d46d-43c1-8f49-962d6cb6a9e9", "value": 236326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583662, "uuid": "8381cc8e-7f19-4c50-acdf-e1bf009b4f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583662, "uuid": "9e5ee9a0-261a-4e5c-92f6-b0523cf307c8", "value": "EFS Quote PO81021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ba54e6-f972-11eb-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1628555601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555601, "uuid": "53305b3a-f3ec-43d4-9ece-afbc37cf5d2d", "comment": "Malware payload (a310Logger)", "value": "cae741484215dc08ea209b09d047638b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555601, "uuid": "f07ef3e6-a269-45da-95ce-711953a21975", "comment": "Malware payload (a310Logger)", "value": "9413de24154405715817e85ae1ba7a4cd58373f9f1cd160f5b6a53f2941199a1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555601, "uuid": "13ea79ca-3b42-4dac-bc61-90545a2b9363", "comment": "Malware payload (a310Logger)", "value": "9b68d9e700544dbee5882a54b0b0eaa5360820f7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555601, "uuid": "8521eb94-bb45-4791-a3de-8ec67fc54733", "comment": "Malware payload (a310Logger)", "value": "902710894b88d8b3897c1f05636e5bbacde56621a1a34f5f755a465772a3c7a7c36f77c6ddf049b8c75c9fc73c6d88f0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555601, "uuid": "eb694191-9e7d-4cfa-8a26-aa3eaf5d8aba", "value": "T1CA829E3AD1224CEED3099030900C59C5CB557483085BFB5B3F74E6F97EB70AA2DD665A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555601, "uuid": "ed27a6d4-1ea4-4a4f-971d-8050223179dd", "value": "384:3+E0T5AO7apFogsIXqYvEIl59nWPdLGHT7I+6EgRFHuNevJW:/SN7cXBvEIlbEKz0UgRFseI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628555601, "uuid": "777b523d-403c-441b-b963-5d577b816a01", "value": 18226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628555601, "uuid": "86a42ac7-c236-4f06-b840-149bb9da05eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555601, "uuid": "e27becbb-6b2a-4178-a0d6-17459fead467", "value": "PO-0142.xltx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456c065b-f9a8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628578667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578667, "uuid": "60ddc166-4023-4c88-8689-186c59409c25", "comment": "Malware payload (AgentTesla)", "value": "0075e2b83a486c72341ceaf957ff492b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578667, "uuid": "8694c681-5c0a-404f-bb0c-91066e8ac1a6", "comment": "Malware payload (AgentTesla)", "value": "949012a9d13acf5498d0efa6c65de0addd48848a43ad6947f4514a177d759e9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578667, "uuid": "7873a293-77df-4e21-ac0d-c0e610bbb29c", "comment": "Malware payload (AgentTesla)", "value": "e9a04b0920daed3d690abda4d1462447fbc5cb47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578667, "uuid": "1f839730-4acb-46e1-bb97-af6055ad5b90", "comment": "Malware payload (AgentTesla)", "value": "4cf9ec5486228b94b8aa955ccbce8ce8da9e46935be16fc2a347b808654e2435d4e5bd84189949898ab7f90b2611b5e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578667, "uuid": "109df553-ff35-45f8-8e78-f685708f011b", "value": "T10BA402027E09D259C0D94A33C8D7575117B27D5266A2C00BA49EBF9B3B73FE72B82742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578667, "uuid": "50d7629b-85f0-4bbe-b9f1-4c706c086ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578667, "uuid": "f2d28b8b-f64b-434c-9d79-ce8a5d4ef227", "value": "12288:scahoA/6p1NO+UAywNyetvN3hL6py7dJrmgJn:09/qtUl8yelN3hL6pav7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578667, "uuid": "e70521ce-d9b2-43a5-8d37-915f72d9de4a", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578667, "uuid": "b2816ddf-4a5a-4987-b701-092e24308355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578667, "uuid": "6958dcdd-7540-40f6-9d3d-7f52e64358ac", "value": "(KOREA SHIPPING - KLCSM).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27c2568-f970-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1628554852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628554852, "uuid": "2ab5d395-8c55-462f-b79e-cb956df5c76d", "comment": "Malware payload (Adware.FileTour)", "value": "32f704bce081a0aa5c9368ab339dc11b", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628554852, "uuid": "4c126669-a382-487e-b3a5-e70fea9d24dd", "comment": "Malware payload (Adware.FileTour)", "value": "9674d5eec506800988ac7469acafaab10d6c879c83aba6ccb023935de5cd2a0e", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628554852, "uuid": "8a3b3abc-2aef-499e-af93-b39cca3ec906", "comment": "Malware payload (Adware.FileTour)", "value": "a49c71e11b0d6addde2b7f3b0196c8577030bb93", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628554852, "uuid": "cf906640-e7e8-4c12-b3e9-47a33dd9d3f8", "comment": "Malware payload (Adware.FileTour)", "value": "3ead78532c65a9b0933dacad817307255854b7d7e1991b3b5c481e325176f897824fa4eb796b3e1de601c82d4ee89ff4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628554852, "uuid": "68643d21-4481-4993-b111-4f5ed6ba86ed", "value": "T120E533603BD384F2E685113B9B0E7BBA71B9D3D8532096A33364CB5E0B39D759227067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628554852, "uuid": "1db42487-b568-46ed-8791-64375d553c6c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628554852, "uuid": "ffd9eacb-463f-4382-902d-67f93650c2f6", "value": "49152:xcBOcIk9r0Gc9tZP+9HqQfbGu2h+xbRZn2zCcEMz+q/uPEwJ84vLRaBtIl9mTv/c:xeGV9rMqQiuZlZ2zLEnq/ZCvLUBsK3kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628554852, "uuid": "4eb91f71-7b9c-401c-8fed-34c6404de35a", "value": 3294586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628554852, "uuid": "d3675941-4a6d-4e7b-9bf4-c10e5bbd51ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628554852, "uuid": "fa73a779-043d-4c5f-99af-9b0561931880", "value": "9674D5EEC506800988AC7469ACAFAAB10D6C879C83ABA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd29523-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628584020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584020, "uuid": "4a16a741-d3fd-4bf3-a907-2f4a32cd8c23", "comment": "Malware payload (Mirai)", "value": "d91f6ab659a7eac2befee1a647d6c0c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584020, "uuid": "19a07892-76a4-4bbc-9265-c64026d63e9c", "comment": "Malware payload (Mirai)", "value": "96e7371472c78adee8c016567e9f2d73ce678aa109846d7302bfef1dbb6439e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584020, "uuid": "3251ebe6-4706-4ba3-8c55-61c18e6e9d63", "comment": "Malware payload (Mirai)", "value": "2d7a553c7dcb5a340d4466d360b94809dcda7b5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584020, "uuid": "526b50be-5de1-4d2a-94b8-79a0b83ad73b", "comment": "Malware payload (Mirai)", "value": "1992a6bf89d30d4d72810990fe202d330e35950d7c4e8c47aa872b027cca973ce3f3a1dc1560f94e4ca75dcada66ef67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584020, "uuid": "dff2216f-49a5-4323-8aee-83ea6ba1ff40", "value": "T1DC830881BCC19A16C6D423BBFA6E01CD332263A8E2DF32069D256F5577CA81F0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584020, "uuid": "23fdcfbe-3e9c-476c-bafd-65858a895537", "value": "1536:QlDRMNNtSPR07n7ruXgjsFOKm9C220H4rT/tOSahWcf/sBuZ5dZq635yJUy:QlDgOQ1j7Km9UHrZOdhD/Z338JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628584020, "uuid": "a3f08298-8311-4cbc-b544-84632a8a1400", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628584020, "uuid": "12a146c2-5613-4c46-9901-d1efe0a43111", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584020, "uuid": "b6566f64-0be1-4c13-98ac-07eef2172978", "value": "d91f6ab659a7eac2befee1a647d6c0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacf1122-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628600849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600849, "uuid": "76c24f5f-bce1-4677-a38b-29bdd6680963", "comment": "Malware payload (RemcosRAT)", "value": "296a5a6f4af5e78c89d5fe10be3124f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600849, "uuid": "d066b9a2-8efa-42ea-b3b7-85e63def6869", "comment": "Malware payload (RemcosRAT)", "value": "98725150107b17b910662a75f73e24494501a3ecee2702e165bfb8e1f4ba93a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600849, "uuid": "d7f82047-c4a5-40d8-b8bb-540c5dad9b3e", "comment": "Malware payload (RemcosRAT)", "value": "df324b668686c2a8509d08c403ce648835c6ddea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600849, "uuid": "b8855690-217b-45a0-8a56-f730ec7bb52a", "comment": "Malware payload (RemcosRAT)", "value": "6b3e0fe2d1451783aaf87efdb0e7f5d268ed153cbf8b9994ba92c3afe34f812b78a6b9576c8c74f49d5b3c5a9eb36bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600849, "uuid": "c529f5e7-c6d1-4eda-b97d-62a3058ce41f", "value": "T1BB35AD0273E1D032FFABA2739B2AE641567878254573852F13982DBDBD702B2563D723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600849, "uuid": "2891691a-c849-4f5d-9197-7451f9ad36eb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600849, "uuid": "9bbd34ab-74cd-4848-b09f-28739bfb053d", "value": "24576:h/CNBKOsWsN6640tJn5mTBQGktmHa2nMviVD5ucpzdwo:yKOaBfIBQG6Ya2nwifucxd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600849, "uuid": "db1170ff-bb3d-4934-9504-309826564d44", "value": 1136544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600849, "uuid": "5b332950-bd43-4419-9ca1-291987d73216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600849, "uuid": "6b08ef9c-c705-4c85-936b-2944a69ec150", "value": "Winrar.exe.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af621341-f9f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611487, "uuid": "5789468d-6f1c-45b2-ada6-e951678ea6b8", "comment": "Malware payload", "value": "05c083a3ef66ad69e1ba8ac427ae8897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611487, "uuid": "91564ea5-328c-4fd1-a197-e9881f940322", "comment": "Malware payload", "value": "99a3e2ebd1bc060c20f9d968c9fb58bca75e81a311ac8b9d0fbf7891f725fb53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611487, "uuid": "dcb91e85-8a8a-44e6-b0ff-a1ad62fa7c78", "comment": "Malware payload", "value": "78aa9b42981b5f4d466d2ec0aa0fe8d3b6e4d475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611487, "uuid": "07ac723e-befb-4155-b728-57e95a7a0b05", "comment": "Malware payload", "value": "9671c1c1dc6f04cb8d2767ec3e996cdacbfcf1eabdf8fd9524a95e15c02ba7b1f741e322573db3cb99f747b20eea2267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611487, "uuid": "29ef4f9b-b3a7-413c-a08a-4acc35aea06c", "value": "T1EEE423CCB1E85176CEC012B169E3C6B147A04E5DEC07CEBB9DD28DD27AB73109DA2A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611487, "uuid": "cfbd6ea5-434f-492c-a89a-a10bf7445fc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611487, "uuid": "dd5806d7-e0ca-43f2-a773-ca5fff392377", "value": "12288:ayB+7T3wXQZzFkhy0NzP7v8yZPQxZ6Xc0c4mh4C93Wk:yzwQGnHZP+ycdhvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611487, "uuid": "85b9368a-38fe-4fee-ad92-cc121b46c935", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611487, "uuid": "ed4956fc-e99c-42c0-86ee-09a6735a44d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611487, "uuid": "8da9c51c-a2cf-4fae-8daa-1be7c63944f4", "value": "05c083a3ef66ad69e1ba8ac427ae8897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f519ee-f9da-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628600089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600089, "uuid": "0902f730-ad91-4b55-afce-568fb9c84dc7", "comment": "Malware payload (Formbook)", "value": "200f1b6cc32e01d765242406ce1cc63a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600089, "uuid": "b9ee8ca1-e4e2-4303-b416-3592e790987f", "comment": "Malware payload (Formbook)", "value": "9aa14501574506627270d8fd1ffba77663640ade1feba0deabbc9ece1f06c0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600089, "uuid": "580e8b2c-99b0-4a62-aa8d-afde0dd85661", "comment": "Malware payload (Formbook)", "value": "1f8e8097b9ef57eb099a0b9dcc68465e4159c8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600089, "uuid": "ff52e406-0467-4a10-95f5-2a54da6e0877", "comment": "Malware payload (Formbook)", "value": "56dd3bad9adb5f5aafd4f8dbe195e58f4ba67fea710da7fcf8ca4a63626b4d8f2836fab3ce4ab585e6a34a8b9bc53e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600089, "uuid": "15272397-a3a8-44c6-b70c-4ded2b9810b9", "value": "T18F3412A5CA520585F8261B308833AD7C0257EDBDD7F821CB60ADF1353B735DAA87A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600089, "uuid": "baa12a31-f1fc-4e04-9cde-f81199842463", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600089, "uuid": "27fb2a26-01a1-4a2d-a074-b4d0b6dfb5e4", "value": "6144:rKoRJD+6EukNMO09vfjTY8+ZpdZQt9FXFZ0KcSTdUwxAEA8:xRRtKNMv9vrcZpXyFXr555AEA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600089, "uuid": "849ada88-9bb8-4e7e-b5a1-8e68d0623f59", "value": 243260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600089, "uuid": "1a36c77e-f42a-4d7d-8da9-c55020142b9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600089, "uuid": "231ad83a-2790-409c-b22c-7035b4821a14", "value": "PurchaseOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b07cd2f-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628600581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600581, "uuid": "5392d207-708b-4d6c-bfd4-57646a0ad771", "comment": "Malware payload", "value": "cf2368929e6eab5b0ad63ca9096e6756", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600581, "uuid": "5e929f1b-3e8c-42ec-bce9-383c56b0f777", "comment": "Malware payload", "value": "9b17fde18f7a543e031dc6fcfeda33940f7b3dba4180916781fd79b68e46cfaf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600581, "uuid": "8dc3c3dd-ccfb-461f-b3b9-81c47b35f024", "comment": "Malware payload", "value": "014c11c2f783f1f144b5466e9c892c84e244615c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600581, "uuid": "9b740c25-b916-4872-88c7-b55edf91e9ca", "comment": "Malware payload", "value": "ab0a21e9cac4588811da74c8a2efdccf8b459d1a215e3b7a84e806bacc6eca4fe4e4b80f70b149bef55f62559f66d526", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600581, "uuid": "428255fb-2ed5-481d-94f6-b7a8a9cc5ce9", "value": "T1B7448D0673C94679E8E70331679BC322DBB6FC3486238527568A760E2DF1594F6633E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600581, "uuid": "68c268c3-e3a1-4bc3-a29b-0fc9cebff0d6", "value": "3072:szD5FT0xcM9a3DUY5A2U6ij4qpXqnnDibAJBVkMcz2L9rQn4J9+3Z5yOV2nWW:m5qmZ3DUY5A2Tqp4nwEUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600581, "uuid": "6da327ce-e2b6-4209-bb4a-6c760fcea1bd", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600581, "uuid": "a7abc8f9-3896-40e1-825d-af72f02fffff", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600581, "uuid": "f4042b46-1236-4420-ac90-8bfa21d65f9b", "value": "minha-conta-13082021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32076e77-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628586366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586366, "uuid": "8f084fcb-af4f-4fc5-9bc3-dc1f8d92c51a", "comment": "Malware payload (RemcosRAT)", "value": "f7254a9c08493d0d105dfb942b7a0137", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586366, "uuid": "08b0f258-4d2b-4104-8a84-3af510c8eb03", "comment": "Malware payload (RemcosRAT)", "value": "9b18ec35cd15fc61fa3ab053e2d83994c78cb7a7f66a3560bae910550463c039", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586366, "uuid": "363a8937-77d0-4043-9f87-ece5b0929c23", "comment": "Malware payload (RemcosRAT)", "value": "97dc52f9cf1571383abbc373020e1750dddc25ce", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586366, "uuid": "c26b81f4-306a-47cc-9244-048f613ad304", "comment": "Malware payload (RemcosRAT)", "value": "98ba5f8db65724d4a75cabae33d61601fc2d68230f23899399520df9471897e79d63f83e13ff68cfae7ac24229264f98", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586366, "uuid": "8749cd7d-8ddf-498d-b76d-cc30b5a3843b", "value": "T14B74237433B8E2493372C9693E32D1A225EB11D235A361E1927B976F9FC39867320177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586366, "uuid": "3b2c31a9-9021-40b5-8822-2088d3d24e7c", "value": "6144:l+8J4dJZ5rq74bvKZKgODJ++zzqurh0V+WPzvIY+u3D+B8wsccBtSoPG:ALdtDbCKDhaYhozvlxT+BVsccDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586366, "uuid": "557906af-533e-4469-b3b9-e2a5c1679416", "value": 362665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586366, "uuid": "41afa7eb-9644-4d1a-bc88-5c6fbdc6f03a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586366, "uuid": "b279f73b-30a0-49b0-ab0f-c290345c9efa", "value": "PDA FORMAT PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684bc862-f9fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614804, "uuid": "e5a363be-7e4c-48a0-bcf3-d6ece3a4c905", "comment": "Malware payload (Mirai)", "value": "dcf97f83a049f7e44db1614a6f7b2fb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614804, "uuid": "c17f8e3b-902b-43bb-ab31-13a2a0dca94a", "comment": "Malware payload (Mirai)", "value": "9b8c1d07bb3e88adc15d20e6de0f8e85806b2160a69d8d25267b0b0c12d5d64f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614804, "uuid": "15d6cf1d-9f3d-4644-8a8d-ba6dc73d19a0", "comment": "Malware payload (Mirai)", "value": "d321f265e256ab2cfd47b6a5e67276e9fda652b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614804, "uuid": "7a817bd8-3f39-48e7-a5db-45e7cd0cba5c", "comment": "Malware payload (Mirai)", "value": "b1db5498f2d72cf348cd8833263e595690596150f71f3b3d001cdd5b8a1316096d8d4c08c669d92c5ece89f22dc3581a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614804, "uuid": "a4c796ec-7d32-48a0-95f6-cd45201e316a", "value": "T161E2F1B8E1FD0B23EC268BB832851CFDB4FEC76D1B9FAD65452DC98248B0644907558E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614804, "uuid": "33d6a3e5-ced1-4289-8eea-aafc87201e5f", "value": "768:U/Vhn8+2t7ox8Umdx/ZFqitj5rAC6JU+d1piC8xnI4sILhnqaSsrHD12:GVQUmdYitj5cC6Jt8xnI4sKqaSsrHDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614804, "uuid": "53ca955a-81d2-4517-8797-d77ff2a8210b", "value": 33944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614804, "uuid": "07500a18-ff89-4901-892a-029de4771359", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614804, "uuid": "95f15573-b900-43ab-bdca-00d06c570915", "value": "dcf97f83a049f7e44db1614a6f7b2fb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b63afac-f9da-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628600179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600179, "uuid": "e1f1732c-35e2-4d5d-b5fe-73d22a340a3f", "comment": "Malware payload (SnakeKeylogger)", "value": "64c96d9482e68988007c36ff8d3764b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600179, "uuid": "2662501c-363f-42e7-ba8a-1b57ef174b30", "comment": "Malware payload (SnakeKeylogger)", "value": "9c52db7859362b52c325ce724f2edbee2b954a1f9e9bf1f98ae0830abeabe8dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600179, "uuid": "96d40ce6-0eb6-4a87-9342-72906093fa9b", "comment": "Malware payload (SnakeKeylogger)", "value": "4e0fbc417a80ead8e64919d30496f01a227c4f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600179, "uuid": "be3a053f-d796-4cca-aabf-fdd9605b281d", "comment": "Malware payload (SnakeKeylogger)", "value": "563cfc95c1e48910263938954e00b2b0d3abf5fef776e8a41354d8d3e18b7174ae8e84ba4923d8c4560da4eb6938a592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600179, "uuid": "29e8bd0e-e36b-4e1d-b344-e5b4ddff9307", "value": "T160E4E1657744BB8EC23F0E76C4422510DBE1E6BB9707F3CB6CE658DC568E3894A23261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600179, "uuid": "2f074c74-e5f7-437a-bb11-ea0eab904040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600179, "uuid": "a9354441-11a3-4dee-8957-4877e7036eb4", "value": "12288:iPCzeQ2FJQIhc2XRv/fpdY+pjgLwXzlmA/W7SGiYZWUzyYlSeMJqQb9HfoZRk4aF:tzT2vlhc2XRvmgCEYZpzy/qCEk4LKIZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600179, "uuid": "97a950cc-c298-4f35-aa22-9a7221490625", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600179, "uuid": "c3368a65-44ca-4920-9373-5fab0582e98b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600179, "uuid": "72367d56-c44a-4205-abd6-9f1477385e66", "value": "sunnyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad5eff3-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628585361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585361, "uuid": "a7890303-d3f1-4f76-a854-8e54daf6605c", "comment": "Malware payload (AgentTesla)", "value": "7a089b3d2f75f9ef866306e6254fc708", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585361, "uuid": "38d69018-c8a9-49ae-8bcd-b7367d05c0bb", "comment": "Malware payload (AgentTesla)", "value": "9f0811d632c4b998b962e2493656a993b9a46a56007fa4d5798325a0830e0fa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585361, "uuid": "08085b50-6bc1-4d59-99d5-b7e254417dcf", "comment": "Malware payload (AgentTesla)", "value": "57d0c20113a4e7b1c6e278659df6589f83d8c881", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585361, "uuid": "af80b082-9d2c-4b6c-91dc-71d9c95eb6fc", "comment": "Malware payload (AgentTesla)", "value": "300ba46bfed0df7cd9c44478cd65ed109139248328d756e86e3420b59c2f4afecef55c654cc4c8ad2cb61208268d1813", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585361, "uuid": "571d4ecb-e322-4aeb-8d40-95803561b5e5", "value": "T16405E0667740BF8EC67A4EB5C0415810DBE0DA77A347F7CB2CE205EC568D2868B2375A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585361, "uuid": "9f3538f8-435c-468c-84be-b07c3828b499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585361, "uuid": "a72195c6-8bc3-4e8d-98a7-2ad84a1da271", "value": "24576:4uQNQA4Q/07dzWY1lxzBaKyiDKIdFxPj/6E8JE57gRptghVxP7:4uwSQ/05WY1lxzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585361, "uuid": "0640391d-5389-4b7b-be65-8b29addf2a37", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585361, "uuid": "77b5354d-5155-4ee9-a003-688fa5f7bf1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585361, "uuid": "cb00eee8-5c23-4667-8a50-187783b3b812", "value": "7a089b3d2f75f9ef866306e6254fc708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34261fc2-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628576491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576491, "uuid": "8b4a9def-67d1-43ef-be6a-a9ea1fdc3112", "comment": "Malware payload (AsyncRAT)", "value": "22eda9ea3b661a44f95397e68b9b99a4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576491, "uuid": "9b917545-1860-46bf-93cc-6ce19ac29909", "comment": "Malware payload (AsyncRAT)", "value": "9f46c4e62dba3b7cb5694a1389a61e6f6df908b61049b53f405dc74e941be73f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576491, "uuid": "361df1d5-f899-47d2-a1d0-18e1200f0ee3", "comment": "Malware payload (AsyncRAT)", "value": "7676a1064cbe2679a0eb65cf5bf7cd0d7f9040a9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576491, "uuid": "60aee6ee-98f6-459f-ba93-1f603cde0ae1", "comment": "Malware payload (AsyncRAT)", "value": "4179db14fc8d5bcd3f83e043c77b9136e9ad535b616213723f8dd27e78a35835c37b8adf7e3c37aede76075aeff91a69", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576491, "uuid": "853c72a5-701f-455c-b0f3-7ff3e1bbe92e", "value": "T126011012C96DA18A93C0DBDF44F84C10A852B3011B28B43A50EA670F180566607EFCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576491, "uuid": "a01e84e9-a1ff-4fd4-bc50-9abaecc5a8c4", "value": "12:/eRcMy7A2+gQdFA6C3I5nt+/9+iM9+DOOyv248KH59+vM7ITkSSsaTsC:/r7ApgSFA6wIZqhMpOSDZa9TPSsaAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576491, "uuid": "2aa68cc2-6f4a-42b8-adaa-2e057ef62435", "value": 734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576491, "uuid": "edc6a1e0-25aa-44a3-9746-bfe7433ed0f9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576491, "uuid": "671addac-9308-4e53-ac54-88feb2e89165", "value": "QGTA335.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cca1b5-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628603879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603879, "uuid": "4d75ef9d-ff30-4e16-a7c0-e250022dbc95", "comment": "Malware payload (Loki)", "value": "514e2771207cd146d0aaacebf15f8cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603879, "uuid": "c9d2cce4-7e85-486a-9fe7-1246dbba8cb3", "comment": "Malware payload (Loki)", "value": "9f66135d831d5ba4972ba5db9e0fd4515dfaecc92013a741679d6cddbe29ab25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603879, "uuid": "1f56c397-8d0e-444b-a075-0fcfa50dd8fe", "comment": "Malware payload (Loki)", "value": "c67bc182541878077c0059b009611dbbec82f78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603879, "uuid": "3edfae8b-db4b-4356-9003-024fcda50226", "comment": "Malware payload (Loki)", "value": "5e0fd4905742042e78c0e30488f26784069618f7651745150cd2eca173a9e49de5dc0c052843ba7083b1f670162412e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603879, "uuid": "2282701f-4833-49af-b0f6-1647f91dee86", "value": "T13A3402309457CE6EC26366BEE12475AC5231ACEA87F25BEBB693F20614857C1F43E142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603879, "uuid": "20bde01e-034d-4288-9601-3b95d5054262", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603879, "uuid": "6294480c-515d-424e-a05c-6fa8e1f2dd5e", "value": "3072:yTPx22c5QpFrHu+5bZDvO927Kvj+/0vHUXcx65V95/h72mIx0x4qhEkvfpXMyVRb:yM2cm7rOY1yCL3Mx6T/FsEJnywPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603879, "uuid": "afaa6a94-4ebf-45a1-ae51-6ec43cae1e1a", "value": 232139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603879, "uuid": "48a55c69-fc85-4d74-87c5-bcd386c36c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603879, "uuid": "5e6e36ed-aebc-4f9e-b23d-c4b5575eb809", "value": "514e2771207cd146d0aaacebf15f8cf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6f7ae3-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628601199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601199, "uuid": "63aabb8e-7d0c-4e16-8122-b6fbcf23dd05", "comment": "Malware payload (AgentTesla)", "value": "0c3b9a7f5c742160a0a806156701545a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601199, "uuid": "13fa8d95-61db-442a-8e04-c6e3915cf567", "comment": "Malware payload (AgentTesla)", "value": "9f824ba3474b90684904530bc8fcdc7587ed86a527cb881386b224d7b5b8ed33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601199, "uuid": "5e40caf4-a294-4299-8d9b-b82eceaea1cb", "comment": "Malware payload (AgentTesla)", "value": "a78620e3fa4d50ab0b07ab5253b89ef7dba4152d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601199, "uuid": "f1f25144-2167-442d-b24f-e4330c7da1f9", "comment": "Malware payload (AgentTesla)", "value": "964ba5c9464e8bd747bc11c1d0048adf6e6225e3b92ceaef9c9d618cfe6c0f359eb51b115c4d41e9af002b43b0d53a8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601199, "uuid": "55e6bac6-4454-4c4a-83aa-803f8540a753", "value": "T1B2F4335899BCE6760A3746DFE011A7214DE4EF2058F21458485C2BBECBD35BEA258FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601199, "uuid": "e1e0166b-979f-4ebc-aec5-9be56c9db3a0", "value": "12288:4SPEw0heOL1kK9ZpcTKNGm0oM+h2ei4LRNUTaGwZRlM3wH7AAbpSyBD1durksLi1:6w0TZ59nh0oMDD4LRNUTarZRenTyBBdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601199, "uuid": "ed0fe9e5-e60f-4cf1-bafc-ae2d4c20b461", "value": 734868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601199, "uuid": "ee137a4e-9370-424e-99ed-8ae2f7f43ce0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601199, "uuid": "99ae35f4-94b1-44da-a083-c26a2368b870", "value": "bill of lading and certificate of origin = container shipping document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9dd6a1-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (VegaLocker)", "timestamp": 1628577849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577849, "uuid": "b857f321-ae6a-4129-b8ae-7e204a8f617f", "comment": "Malware payload (VegaLocker)", "value": "b6e9c6f1113c92ad6757266ae75769a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577849, "uuid": "28354273-ab2c-4160-829f-b14ba9db1d92", "comment": "Malware payload (VegaLocker)", "value": "9fca4b9bb2238dec26fc6b6161dc9d62647883966f1cfd661537fb8c097ff4fe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577849, "uuid": "c54356a5-41cf-4862-92d9-f981e4cef868", "comment": "Malware payload (VegaLocker)", "value": "9190e8d268db4deb7cd97624b17cba6617244699", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577849, "uuid": "4e4d314a-f05b-4d33-ae75-7100765e0089", "comment": "Malware payload (VegaLocker)", "value": "6134a05521812139947ba9fd8adb20077ccb4bf82c5f55d2b8d68b159fbfc0620cc280b1725139b4752e55fb7bef6c4c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577849, "uuid": "afd23bf8-b249-44d9-aa20-54bc60a73fac", "value": "T18305BE50EA0411265EC353ABAC1216C2FD7CD11153402265E9AE939C7B879ECD3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577849, "uuid": "5b9701d6-2f6b-4f86-9424-a8971b13b561", "value": "12288:za2JVMABhUnh9ERTf4R8wuxkqCrQPb2j7fH2C4CO7Kl8N:za24ADUhd8RiQPSj7fDU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577849, "uuid": "b5ef7467-9e0c-4305-9a70-addfceca05d7", "value": 795163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577849, "uuid": "0b332af0-ccf4-4679-808f-4066f3ad78c6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577849, "uuid": "96c8bc1c-9628-4219-bb90-33e574c481d8", "value": "4085.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79009bd1-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628608819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608819, "uuid": "4d3f6869-38cf-4c00-b99a-4d52a5674139", "comment": "Malware payload (AsyncRAT)", "value": "2a2cb30aad7f963c02e030616945fcd0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608819, "uuid": "8c4bee58-ddc4-4924-8a0d-ed660ae407a5", "comment": "Malware payload (AsyncRAT)", "value": "a06b140ab8f1665d9dbacaa20da469622ce010c01a7fcef3b69121440bc3019c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608819, "uuid": "09a0f359-ce74-4581-a3d0-3dc792eac96d", "comment": "Malware payload (AsyncRAT)", "value": "3990931750e1415ad539fbb4c31c31f45847aba6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608819, "uuid": "73316c03-9129-44e3-a980-343062837529", "comment": "Malware payload (AsyncRAT)", "value": "ee190e35f4afea3a3e7ba3c15ba2539a2390a81461d265408579de2d9e5f06543cbc2fd80c71e41945c080930045554c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608819, "uuid": "e12c8b76-6377-481a-846a-55d95ec40043", "value": "T11A231B0037E9822BF2BE4F7899F26145867AF2633603D64D1CC451DB5613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608819, "uuid": "1cec2db3-3849-4cfe-816b-dac2f6f0a435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608819, "uuid": "1c68b4d9-992f-48af-8c25-aa4e23e44edb", "value": "768:quZPpT1Uu4/cWUeC66mo2q1MDEbHB8+OPI/TzjbXgX3iqSo50LBDZwx:quZPpT1tr2DyR3/T3bwXSqSocdwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608819, "uuid": "4d6a67d7-9d67-4b9c-94b2-9e5d06b4cea7", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608819, "uuid": "d0817da0-b4cc-4b3b-bf9a-564ca7e87fdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608819, "uuid": "0b23e720-3038-4d54-9c22-a678762c802e", "value": "dGSQxmfNFwvn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cc8144-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628574298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574298, "uuid": "37edd207-3d64-41d7-84bd-25b6e63e6c38", "comment": "Malware payload", "value": "5877b758e26c171bc2d69617c8af7d7a", "object_relation": "md5", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574298, "uuid": "4cafa24b-8991-4214-b1a3-03bbe25a2eda", "comment": "Malware payload", "value": "a0bd8e259e4cc4c3ee22e4a0fcb24efdb68f08910383a7879759a129d30335f2", "object_relation": "sha256", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574298, "uuid": "a4400f5d-22cc-451e-8c4f-a1ed68bc3c52", "comment": "Malware payload", "value": "ba35ce2bf38b50352086835bfeb51dbd04866fa2", "object_relation": "sha1", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574298, "uuid": "e8ff99c7-d77b-466c-aab2-94743f89c8bc", "comment": "Malware payload", "value": "e5a1a4c8eaa67792d8d84c41a22cbfb5cdae8b76917c65b80ce9334d31afa49dbe2caa38000cfd1c0e9251783f1db515", "object_relation": "sha3-384", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574298, "uuid": "b48213ee-ccb0-48ce-a151-92d339e61731", "value": "T15145D85835A7D8CE824D599F6272AD892D3A07BF8657064D34399B1CC057FE80BE0FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574298, "uuid": "395538af-ce04-4aa2-951f-ed96f21af76f", "value": "24576:9HPvpWx+4/d50yTs9s9sUs6srsrs/sQsqsAsES9:9vvZyTs9s9sUs6srsrs/sQsqsAsES9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574298, "uuid": "8dc6bc2b-28a5-41ba-9eff-53ad5cbd6ef7", "value": 1165097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574298, "uuid": "70111908-7cf4-4e98-87e2-e1b36ce1f292", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574298, "uuid": "35050577-56e6-449e-bd8b-9b9864ff896a", "value": "Ove.vst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36b1327-f9dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628601642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601642, "uuid": "e328e61c-7673-4744-90ec-0b557ba2506e", "comment": "Malware payload (AgentTesla)", "value": "f575ffd0724dc258fbad6601d4a2e445", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601642, "uuid": "34466a92-153c-455b-a604-e31d9daeeb06", "comment": "Malware payload (AgentTesla)", "value": "a0d4d2179c499e40d11c63dd1c55c0cbb669b633ba64cf5b6c4aea2b5b1d5ff9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601642, "uuid": "7ee821f4-e152-46e1-a986-f0e65814862b", "comment": "Malware payload (AgentTesla)", "value": "6c7df588669db3bbe909b720b0635eca54a5e576", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601642, "uuid": "a5d7f3bd-84dd-44d9-82e6-5b0fda41621a", "comment": "Malware payload (AgentTesla)", "value": "0b2a72bcc493d7d54ea8740b767db0521428874a7156318255ac5f1f3c9030ed08038be800b12a78b6984b4274396244", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601642, "uuid": "3580ddcd-e9db-46df-8ddc-71c700220753", "value": "T1D122A014D9255543C71A81B92354805B720D3A16A52EAACF600C739DAB193F65F8BC4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601642, "uuid": "a2ebf570-7ac6-4dfb-bf42-65351c1b3b4b", "value": "192:xrXP/g9SGp1y5rvD3v4fFgggDzmRk2TloSryjW7stBUu6FU1C+zeIj:dXPSSGp1y5rvD3vGnEm22xoSraWgUu6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601642, "uuid": "451e7219-7039-4537-baaf-bc7dc06b5629", "value": 10720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601642, "uuid": "f07f507d-3b73-4ccd-b61d-af2ceee2291c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601642, "uuid": "dbd1de3b-c5de-4b30-9b27-e6df68d41430", "value": "Checkpoint PO#948493.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3e3030-f9dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1628601415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601415, "uuid": "ce6e4154-060e-4daf-aa3b-27c6bd3605ce", "comment": "Malware payload (Vjw0rm)", "value": "48b712251e849852aac13fb40c12ccc7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601415, "uuid": "8b5895c7-df31-445f-9d11-c42d2856063f", "comment": "Malware payload (Vjw0rm)", "value": "a13e8c01a39824718b9beb603a1247e48c98fe9d7b8b2770ecf5ebd7daeb6bb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601415, "uuid": "720d6702-0506-4f7b-b517-28faee2b5c22", "comment": "Malware payload (Vjw0rm)", "value": "886f19f88ab45e77c6f0dab1e1ad6e75e1b6d133", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601415, "uuid": "37a0a97e-9d9a-402e-a172-045f332196d7", "comment": "Malware payload (Vjw0rm)", "value": "d93676c69a4ea5326edb4fd70caa8859b8dbd47b6df3b1104414e8dfcf8f3c54482bcb0d941cdd0634b62cf8cdd7d482", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601415, "uuid": "36f43593-189d-4bd4-adcc-6f668afd35c4", "value": "T1B3E4F1116B885BF4C7980A17D0BEA609A3F2539BD69274CE7B277C8B0FBFD44361510A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601415, "uuid": "c92cbadd-fb26-466f-9462-84b9b60d6962", "value": "12288:s3knVd5v5LTp3ZlaMlD7R9nyVZf40l5qPlf7LTvQa:sSZvREuD9ES0YPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601415, "uuid": "f3a29c37-4be9-42ca-ac15-42d41ba60fba", "value": 663029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601415, "uuid": "c8295ebb-d609-462e-a31c-d82344574502", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601415, "uuid": "650180b4-2258-4d71-b866-94e3cc9c3f00", "value": "ORDER-218105.docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3307ea2e-f9fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614285, "uuid": "80505b51-a7b5-404a-946e-6b1b61bee4a2", "comment": "Malware payload (Mirai)", "value": "a86998e3ad2bce6eca79201c4d00548f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614285, "uuid": "4ee30a53-687e-45f9-bfde-5ed832b4bb09", "comment": "Malware payload (Mirai)", "value": "a1ea662156198e886489df21409fc593251c7e3a84f3099eb453a4f82168b6ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614285, "uuid": "9fe116fe-7b7f-4ef4-a790-de33f2e7ec88", "comment": "Malware payload (Mirai)", "value": "37657cfcf3ad20a1857260d58acef94ee4d8404e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614285, "uuid": "689efdb1-abb9-44b4-805d-331f1efae4e9", "comment": "Malware payload (Mirai)", "value": "654ac95c7ead0b72dc1965f89e10a9056daca0dd3cb372ae24a67ba3a845b481cd21df2bc7b1b2c2a8747b1a6c96c2b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614285, "uuid": "b6ed5510-8b37-49ae-a9ad-0754e7d6f10f", "value": "T10713F1253A1E2201D38870B1D79B1DBE03AE12A0F4A517F7E26709097C4B51FB3EE592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614285, "uuid": "105d4157-5006-4f21-849d-e26c49bb99cc", "value": "768:lR7Dx4werXS4SHcemD1BieKOcyy/vzkrjKeDHsF/iPzMEdPH0DFpE170:lR7Dx4wer/SHczDTieKOdCSj3HmodPHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614285, "uuid": "ed45636b-da9e-4d44-81ac-78fc90cb5a9a", "value": 43456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614285, "uuid": "55202420-1055-48b7-9aba-b5e252157a92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614285, "uuid": "d367e76d-b819-4f0f-829d-58385662b6b6", "value": "a86998e3ad2bce6eca79201c4d00548f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26317c70-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628581192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581192, "uuid": "a7dabb40-4db6-43e5-ae16-6985f7e956a9", "comment": "Malware payload (DanaBot)", "value": "731926fda7aeb87453452a78e89f1c77", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581192, "uuid": "ba3637a6-1025-4599-b0b9-c0561396696c", "comment": "Malware payload (DanaBot)", "value": "a24a06112f0b98ce05e7bf6ff3d65c242ad34e38c35e9179b313c2bf168119ee", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581192, "uuid": "1fadb463-dd3d-479a-aa78-0f2652528ff7", "comment": "Malware payload (DanaBot)", "value": "f38d24275b8c2b78044d652cac8b56b0961e8a09", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581192, "uuid": "309637e6-b5b1-405c-a779-ba5d71c5f887", "comment": "Malware payload (DanaBot)", "value": "e626d39a5702e6124731b0a9e76af3e559907fc3dc59fcb2ef7c51764fd2a86c04f14c1e0f017bc59bd1b67b7bccbf23", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581192, "uuid": "15379379-0ff2-48c8-afd6-ce34a8c825ac", "value": "T1DF3522717A90FC31E4E74670342DCBA5FABAA95067604A9B2348BE5E5E333D0D339316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581192, "uuid": "a513c209-0b93-4693-85e7-18c5d11dc2a9", "value": "97856e36aca27ff13ae687d21f9f6f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581192, "uuid": "8956ace4-bf8d-47e9-abdf-729dd3521b5e", "value": "24576:2dfcaEwI2KgKrMIc4UbWyuFkNnGlmIBoIbxzywP6uu+LS/M:267wINHMV4UyyuuNnGlmIeZwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581192, "uuid": "37d85b95-c51d-48cf-a5d4-a56256b7c2c5", "value": 1143808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581192, "uuid": "6be193cb-52a4-4c86-93cd-499e57aaa811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581192, "uuid": "eba6f2d5-f573-4f6c-b709-04965b69fd15", "value": "731926fda7aeb87453452a78e89f1c77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00ab871-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628585369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585369, "uuid": "b9b5044e-d3b6-46d6-989a-58d3480cdd24", "comment": "Malware payload (AgentTesla)", "value": "06201b6b2888cb1e4c27d77a5a28bc52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585369, "uuid": "85c7ef2b-43ce-4037-a649-9a4214be3c39", "comment": "Malware payload (AgentTesla)", "value": "a24a961e14dece3def554ebba529567d698163848c1611dfbb97f78b08c1138d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585369, "uuid": "71b23b1a-e1ed-47b3-9652-81e3c04d5b6c", "comment": "Malware payload (AgentTesla)", "value": "985f2bb91db6f82b7fbc8923e5cd45bba0f2da47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585369, "uuid": "a429b060-a752-4c06-954b-0e81ca669be4", "comment": "Malware payload (AgentTesla)", "value": "b32a0bea88928f5213b084e2152a0e22799a3206113ad6dd206ee8efccc074413108af0fbd3f8da8e5397b6e270daa9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585369, "uuid": "d662651a-40ac-4456-b48d-9d23b390c4c5", "value": "T17805F1653781BB8ED13A8E75C4415910DBE0E2775707E3CB3DE209EC568E2DA4B233A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585369, "uuid": "60f7bd71-686a-4783-86eb-0449dab86111", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585369, "uuid": "a64c5482-4f64-4fd1-8dec-c6c88a2bb0d7", "value": "24576:znKzDT02b7lWHuYCOMmnm+r3LIifVl8C:ePI2HbYCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585369, "uuid": "f89ac329-b88d-452e-9830-3312f75d4e25", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585369, "uuid": "1c9f1d99-64d2-4af4-8e5e-1eb8eea24276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585369, "uuid": "b1c7e098-93b7-46e5-a46e-cc20b222974a", "value": "06201b6b2888cb1e4c27d77a5a28bc52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cfd9c2-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628578047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578047, "uuid": "1aae8495-536f-463e-b05c-859501d5e8e1", "comment": "Malware payload (RemcosRAT)", "value": "e374b211c2d5d00513f81d87450a4a32", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578047, "uuid": "e6214e2b-8919-4cad-8fb2-9d807deab428", "comment": "Malware payload (RemcosRAT)", "value": "a2611ddad5f039debf43eedc90fa623f0cddcc15cf7ccac5077ebcfcfaa1ff93", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578047, "uuid": "0ab06f35-7c70-4718-b54e-43214aec30c4", "comment": "Malware payload (RemcosRAT)", "value": "1706a652d542fab2a7d882889ead98122523f201", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578047, "uuid": "827cec36-e553-4ebd-a82d-83fa75a02820", "comment": "Malware payload (RemcosRAT)", "value": "3777e5a1683bb1bdda261d037a22113f44a97f4cdc4e17c068b2aeac8fbbdc9d0f04eb60ed560dfc48ad4dc20bd09e67", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578047, "uuid": "59cdbd63-538a-45ad-8100-f8633effea5c", "value": "T11FD423A4207C5204F388DD548770E28C72C64FEB1B6B65E7F809C8986E57AA1513FE2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578047, "uuid": "30dd8924-2b04-4d27-801c-e66cf1c78b1d", "value": "12288:/+xIvkQUYDSKBh6JPER+6x982Lj5MfSCLd3jJIKaonwyaVER9kAijv:2xIMYDSZHIX5hCLd39/nwyaVAihr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578047, "uuid": "a7447645-f64e-4d56-acf5-c1d544ba6215", "value": 637110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578047, "uuid": "126d9073-014f-43f8-8c8a-bc8c15c8318b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578047, "uuid": "64dfd209-7676-44b7-aca2-acad737a366f", "value": "Quote#78945_2234#.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1089b4de-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628600483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600483, "uuid": "f6179859-6f61-40d1-b085-b4314c7b3931", "comment": "Malware payload (AveMariaRAT)", "value": "740d7a3e4b5756182e0bc9777d75f047", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600483, "uuid": "4637c0d7-cbb2-4f4c-9897-9de59e6a0133", "comment": "Malware payload (AveMariaRAT)", "value": "a2697056dbb13ff4ae122354378f194b52f235e99d860f6a7e0a9c048a310681", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600483, "uuid": "30c0a07d-fd27-4ac7-b937-01caceb95073", "comment": "Malware payload (AveMariaRAT)", "value": "1a25f0e590a035ef27a63b801b49bde4b3b8632d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600483, "uuid": "dd29558e-1f69-44ff-895a-25dcd3c2a0a5", "comment": "Malware payload (AveMariaRAT)", "value": "b501f4b4ccd4c61f711f16d9e1173fa715b4e4f4f483af7f82e39c4b08e003b01a3e5f2b43d2f9093579cf8bae9247b4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600483, "uuid": "a4c6841b-64ec-46b6-b286-f9dff2d18728", "value": "T1C8B39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600483, "uuid": "13801edc-886d-47ef-a416-d4ab533e3d2e", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600483, "uuid": "69b0c1e3-e3a5-45a4-87d1-07cf983cc09e", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600483, "uuid": "6f9a4a6d-8b88-4615-a337-226c7c86fc3e", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600483, "uuid": "4e9707ca-bed2-41fb-86d8-b2ac051bd5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600483, "uuid": "7f946494-5bc2-465c-bbcf-5556c4bfd5f0", "value": "order po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc88a71-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628576430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576430, "uuid": "7cee1b08-f16d-4e10-bd54-6202b4574ca6", "comment": "Malware payload (SnakeKeylogger)", "value": "0e4b71cc1ea1770a5621335e857a5b1d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576430, "uuid": "af96d94f-1298-42f0-9d51-72a6d224e482", "comment": "Malware payload (SnakeKeylogger)", "value": "a3aeffd955a2d75b33f2d8f35dde1979c3b7e4d08bb642d3bef7f0805289bf17", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576430, "uuid": "eff5b087-845c-459a-b451-91d582355266", "comment": "Malware payload (SnakeKeylogger)", "value": "70148ec593805a5095bad428ba7c303bbf91bf94", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576430, "uuid": "eb5b50ef-46e4-44c6-8702-6883f57b86a0", "comment": "Malware payload (SnakeKeylogger)", "value": "d5384d0ce941c2071dd43647a2d5bb73195857874d9a07afffbe3ffff7262907e869359887f5cf3bd05195d84ba839a0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576430, "uuid": "be80facb-b7c9-415d-9818-fda805263a03", "value": "T1273395ACE45305988F86ABB8271BAF55058C366DF785A5333278977937E1D3B602383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576430, "uuid": "3120be10-a8bb-40cc-9859-1e4db18593c7", "value": "384:ePYAW6/zCAvy2CZRX/EQCenXYH+mOFUyav8flegX5TUN:ewA7CAKGQNNmOtaUflEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576430, "uuid": "dbdbec5c-2ebc-49d5-a49b-7b8e020fd53c", "value": 51961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576430, "uuid": "51430534-b999-4355-b793-267ebc8ccd47", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576430, "uuid": "8fc8c9f8-3287-464d-b98a-6d028fd10dfd", "value": "INVOICE REGARDING PAYMENT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c308f7-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628608815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608815, "uuid": "d8e34178-f50a-46cd-a114-f389f7b8d266", "comment": "Malware payload (RedLineStealer)", "value": "6cd5f89c64944a1dccc26e5283783439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608815, "uuid": "563da54a-e1fb-4710-9902-c35ccef7de24", "comment": "Malware payload (RedLineStealer)", "value": "a42fb022bac3ff6defa0d1fbcfc2b7c18fb90733f43c14f6941e4b952e145879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608815, "uuid": "47120321-5215-499f-99f8-030d4b800a91", "comment": "Malware payload (RedLineStealer)", "value": "4ed1dc5550ee98115f3198d760f6efa0741bbfbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608815, "uuid": "ce093ef4-e17c-42cd-a08b-2167804ce0bd", "comment": "Malware payload (RedLineStealer)", "value": "ba1d05b759778fd7bc8c7aafc05145b522016ad949d01d8448a609fc63395fa521e8a8a52f497048187a6d70884f193c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608815, "uuid": "139591d0-8614-4d27-a4c4-d4d9d876adf4", "value": "T1D305BF513288DE96F0376BF2446E906013F9B88FD331CA4D3E867A6B59E77421167B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608815, "uuid": "9e890826-92b0-45a6-89df-f5e54af967ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608815, "uuid": "45a2f9af-0c42-46f0-b5e2-6fbdd198c772", "value": "24576:/WhNIXkXcV/78QShfAofoXxcPjOIzNK6d8K:X/7HShfhUcbE6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608815, "uuid": "f72a86f6-2ddc-4e1a-9820-89d2103d3972", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608815, "uuid": "c538baac-91ca-422b-98ea-6d25e7789a63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608815, "uuid": "d5197865-0925-4781-a90f-9861f5b615be", "value": "DOCU_SIGN09984027330540087PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbe912b-fa06-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619031, "uuid": "aba1c2b8-e5bb-4a8c-90eb-ad4c8a333626", "comment": "Malware payload", "value": "f8fadc750ba7c1bda56b1689924743ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619031, "uuid": "7bc4c04c-b7a5-46af-89e7-63b7453f5258", "comment": "Malware payload", "value": "a4561c8115ba9a40d8ccc6411379e8db03ac8540c681b8aae63763a7e8c10a27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619031, "uuid": "ba278c39-8d9d-4e26-be67-ddc82c113617", "comment": "Malware payload", "value": "4caf46db9a65dfb5bc5c125bdaaa6c2048b22e8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619031, "uuid": "a7a07253-a866-4c2c-b85f-6d5370858241", "comment": "Malware payload", "value": "901ea4935466b5f50f37f729d96588e6fcd3a360dfe0bcf17fa75805f1482cd062addaf2bf74529c8d27a90d16082deb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619031, "uuid": "bd9d8d5f-66b5-4a23-8e1b-c6d2e3327d37", "value": "T1E9263330EAE0C039E17616F815A6AB79B91D7F50972410C762E52AED1638BFDCC3076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619031, "uuid": "357135a1-efda-4fda-87cb-ad2d495e0a24", "value": "e3cf60b4d5be6f57956398dd6440990e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619031, "uuid": "c3fbe4d7-7620-437b-9757-b9881df24c48", "value": "98304:6Iev6FAUK0yeGoUyB2CguC9zlb0WheNDZSApIksg8MnK:6OFAaGouBt0ZDZHp3RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619031, "uuid": "a055305e-21d9-4ff7-9688-4b81d1f04bdd", "value": 4708392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619031, "uuid": "2e59cf25-a1a1-41e0-a558-bc930e4be89d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619031, "uuid": "d4c1d14b-368d-44b7-bee8-eb81f9546c97", "value": "f8fadc750ba7c1bda56b1689924743ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041645be-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560519, "uuid": "47709ff3-1d57-4efb-b47c-843e58ea1723", "comment": "Malware payload (Gafgyt)", "value": "32590138ed7f5ee6b110d9fb3d55a310", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560519, "uuid": "916d408a-f7f7-4edf-b057-31801587bc48", "comment": "Malware payload (Gafgyt)", "value": "a4d196365743e5fe33cfc0ea7d8ae06ebf588d72e48604dd6418452a19dfedb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560519, "uuid": "b94fdfeb-f0e0-45ec-b059-efb29376ac62", "comment": "Malware payload (Gafgyt)", "value": "cfac24d819808e1f78ca774f61d93b3fbbe17e1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560519, "uuid": "47985373-e197-45e4-893d-2f9f44aa6130", "comment": "Malware payload (Gafgyt)", "value": "43d3e5ca1ce1f38370678f90fb10b9d8cdd8e3a96f987d011116c72627394b5cb8bcdbca8fe89ce0017a69344dd64f1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560519, "uuid": "a93f28b1-abe7-4e27-a795-3b582a1d1277", "value": "T1DAE3926ABB618EB7D84FCE73069A4902148C95C653D97FABB2B0C56CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560519, "uuid": "0b603260-6b09-4e72-a2cb-925b60a7f701", "value": "1536:P0/eTNRsHrRDjMcZkHNc1PYeH/Qs1xFhWW+sPFUmkV0ZF01TDtM2ke:P0Hjn7bH/VFhWkFUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560519, "uuid": "a0534a64-8d9e-4734-a4b4-6a174e293236", "value": 147022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560519, "uuid": "b8d1bb10-5611-469b-a18f-d2e79a432a52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560519, "uuid": "4b21a37c-6a5a-4167-9174-824d858b0aa2", "value": "32590138ed7f5ee6b110d9fb3d55a310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b63f88-f9e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628606018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606018, "uuid": "30f5492d-61c7-4d66-950d-347aa942659e", "comment": "Malware payload (TrickBot)", "value": "56c53c6dd2ef64e457efa534ffdd4107", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606018, "uuid": "13d6d2af-4173-40b4-80a3-8e86b0150baf", "comment": "Malware payload (TrickBot)", "value": "a57207ec582b45d43728d1cee51da3cf96449d4697b08a090d36a62e9bbd9278", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606018, "uuid": "e3a71a05-6c56-4866-9072-98fbbf8e1df1", "comment": "Malware payload (TrickBot)", "value": "6d5823983d2701a638a8332db240f9d07df68bba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606018, "uuid": "3da5c8b3-1b36-4104-8d7e-15c72dd554d7", "comment": "Malware payload (TrickBot)", "value": "0e3ec4b4f4faac24b33a2d5bc3652b9eb5596c7f51e685d3088be046a616b464f87316cc02ad34d97d394616c4b8ff4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606018, "uuid": "e3b10d38-27b6-4c3a-80dc-c983df7491a7", "value": "T11394E1313280E472F163107489AA8ABD5AEDBCB04B6015D777D42ABE0F747D1AB3925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606018, "uuid": "f862f372-c7e8-4295-a566-1798d7f0eaf7", "value": "e0b50ac12e1dfba4d95affb2dd541de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606018, "uuid": "11238006-3944-4b25-b529-44d670b3c9bc", "value": "6144:zjrzNW0NujooVXF8YqzygIWertnNQrmBPHU6fGkY48Y9sO:000ooVXFB6yBnNQrIPNGkYLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606018, "uuid": "d9f8e0ad-1da5-4e12-bddf-ae59bc81bf3a", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606018, "uuid": "69cbd4c1-7ab6-49fb-8cb5-799181806a75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606018, "uuid": "727d2238-ad2c-4941-9ccf-37c35501f5d2", "value": "56c53c6dd2ef64e457efa534ffdd4107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0b0203-f9b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628586064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586064, "uuid": "28f0b04f-565f-42d8-a7ae-234ba19a57b7", "comment": "Malware payload (Loki)", "value": "0e53a7d60c3fb8455634e9adb83ff3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586064, "uuid": "c0243cc8-03c5-49e9-8564-b77517bae017", "comment": "Malware payload (Loki)", "value": "a576c7f2ef99f454afdd5c93e22bfdcd0dcbe75c2bd909f37fed84226caaaa14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586064, "uuid": "42ae516e-0293-41f1-ab79-23b45a82fa55", "comment": "Malware payload (Loki)", "value": "75a36f3f7fcb39870c51c0221543422b8b01ead3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586064, "uuid": "fd2922c8-8a3d-486d-867b-28afc0589a44", "comment": "Malware payload (Loki)", "value": "a276318f57457b9356c9b8114130082f90d4e32984378afd6e4c8d45b939e50bbe5e313fbf982ee23d3be30c1fe54e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586064, "uuid": "eb4b329c-89e5-4556-b5cf-428a3cead7bc", "value": "T12F34021095EB6117CCDCA4F29623EDCC9606C2120BB572EFAEDCAA1ECEE4DE2503515D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586064, "uuid": "6a1ade05-adb0-411c-b4ae-b8fcb3064577", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586064, "uuid": "5e2aad84-1b21-472a-9650-3efcdbf4278d", "value": "3072:M/e0Fl6GSFbCAXkH+aOHvoMmX5n3iyT/L4OZVAJ7m/LD8VLu/WJZWoYkaF7yNA:gl6PCAU8Fw5nSbOZVAJ7m/OnWoYkoGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586064, "uuid": "2c3b089c-a7a4-49a9-bc87-a1e3f963c066", "value": 232503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586064, "uuid": "f736bc17-a5d9-43d0-8dd5-04d51fe13175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586064, "uuid": "70191bfa-752c-4115-86cf-c9fb5b957c0d", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbf1fb0-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628603188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603188, "uuid": "fe8b6d4b-0a8a-4369-bec8-f2ea590125d4", "comment": "Malware payload (ArkeiStealer)", "value": "8921419a326e6ab947268cb5a385bb3e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603188, "uuid": "8f12e6e4-e8ac-4688-8f7c-6815a7785225", "comment": "Malware payload (ArkeiStealer)", "value": "a65f068b9cfb1a4cc30b0e04f7e48fb6090a23dd3e95836fdfabc3b03fd18fc8", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603188, "uuid": "92e55233-909b-4fa1-b610-247252f3d3f5", "comment": "Malware payload (ArkeiStealer)", "value": "6d1b39f34ef1ea36fa5d9fd5b5343ddab47bfb00", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603188, "uuid": "6f699a54-1e59-47c3-8410-27f8a110fd8f", "comment": "Malware payload (ArkeiStealer)", "value": "c2753d484660d4776b76c52965f8a6341dbc4325af62d15c90f738e66f28defd81316c36a0dbb8307974f95ed9831982", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603188, "uuid": "972a75d3-5a53-4710-b4cc-c397e3eec6aa", "value": "T1B6748C30A690C034F4B612F846BA937DA92D3EA18B7451CF92E516FE17346E8BC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603188, "uuid": "54a84669-69cb-4dbe-a166-5120715545eb", "value": "9e69c87bb37519c7f1f7d4ff41d9c1a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603188, "uuid": "90cc2559-5087-4637-98d3-9544e2984200", "value": "6144:B9GdJNFh+PxDTlV+pMhp1kDrA1MWGmOWsx6/O/yOmBnZ/:+NFhwVipMhpkroMWQB6BOmBnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603188, "uuid": "59aa9001-7a39-43d7-bf6d-5823cf09567f", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603188, "uuid": "f08fa558-65ad-4255-9c9c-3bf9fdc1246c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603188, "uuid": "11616d3a-d2ad-4131-8a08-d57df0460c1d", "value": "8921419a326e6ab947268cb5a385bb3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562732b4-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628600600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600600, "uuid": "d6923872-6d40-4b13-9b41-d7202d86631b", "comment": "Malware payload", "value": "f646d7af017097873e3687d06d002038", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600600, "uuid": "983e9a75-9f38-413a-88a6-467bb54c4aab", "comment": "Malware payload", "value": "a6b2218394db3f6ad9911926980623770c57e00f65ebb51156c08e4ed811c5ca", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600600, "uuid": "c05d6216-d281-4a0d-a5dd-eaccdb360178", "comment": "Malware payload", "value": "6b46eeb2c43aadc4517c6a24bcfb3ef72ee33499", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600600, "uuid": "827e8994-118f-40a7-828f-17ae9ffc1d8c", "comment": "Malware payload", "value": "37eee6b29435d524085a97d2e26724e016cf9150cdc1cf5e1e3f0206f5d6fe791a4615175a70d9680c25d9213dd47e01", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600600, "uuid": "f108d83c-0847-4e2f-bb81-7c3d8da90ff3", "value": "T16DF5A22192727DDDEA63A2BFA1ED4FD18510E4F0E509EA2B233C2B645ED121971F3943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600600, "uuid": "0443469e-9daa-4d5c-bad3-17b128602c5d", "value": "49152:ql+vY5AZH9Z/lktBO0hRa6R8a31G1ZKFP9sgheL01SU26J+p9I6K:tY5AZdZunJr9G1ZUu4x1n2lI6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600600, "uuid": "2865346b-62a6-41bc-bdee-57ed4ec46db0", "value": 3403776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600600, "uuid": "e94d085d-9ccd-428c-9043-b69e49757a19", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600600, "uuid": "5d2252b7-5817-4533-af1e-063184f0c9bb", "value": "BRInfoViewBR76209060.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6c3aae-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Neshta)", "timestamp": 1628603619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603619, "uuid": "19e886d3-f76f-45a4-9f87-d22ea491d080", "comment": "Malware payload (Neshta)", "value": "683cf86c1ee9c503928e97115a8b4083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603619, "uuid": "a8cea814-1c6d-4ab8-bde9-71736e889d24", "comment": "Malware payload (Neshta)", "value": "a77f609628b6d221c0b6b29879394867eada874cbcf0f334197ea1a98390d062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603619, "uuid": "139a6636-7b2a-4990-9b30-271879f58fac", "comment": "Malware payload (Neshta)", "value": "30e8e7278bb52698015c1d844a75a554250278f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603619, "uuid": "18f84d51-3759-4cf5-a58c-8b31a401bbbb", "comment": "Malware payload (Neshta)", "value": "bdceda5d228de171613a9c102f7945351936f66d9dd4c9b0e1af04c72cf0cdc2e0ca6298e8d6b29db868f9d454f9bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603619, "uuid": "40c6c0d9-1c0f-4f35-911b-e9b03a65b2dd", "value": "T1AC8401DDCA03090BD065CDFD8197A21CA82454E5D76AAED702E5FA2E077C6C0FD362D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603619, "uuid": "57567d75-ae79-4875-bcf8-f8c987a4feaf", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603619, "uuid": "92301731-5b31-4e01-8b1f-d9ed9abf1a79", "value": "12288:JIOiPqBwBnyOK7vEWEnlAOR85EKgKjj6Bd3M1w/ZrA:JIOiSu5DyMWEl7RWYKjjcFVhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603619, "uuid": "67f2eca5-acac-40b2-8a84-8325e7f8c0b3", "value": 399384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603619, "uuid": "248e6543-bc89-4cbb-b072-4b3b127c60e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603619, "uuid": "297e9b48-77a4-469a-810e-655e997d83ed", "value": "683cf86c1ee9c503928e97115a8b4083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffef5182-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628581557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581557, "uuid": "a598ed0d-911a-429d-902b-dd618f766514", "comment": "Malware payload", "value": "248f6c38303828b7957fe209f4ded58a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581557, "uuid": "46f392c1-49f3-4462-b569-4efe725d8bab", "comment": "Malware payload", "value": "a81629bc0ec1845d4c6b2cb2adfc83e6157cb88468bda37df475bac7caabd847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581557, "uuid": "6a51b1b6-5ebf-4037-8dc4-ff43477cd8cc", "comment": "Malware payload", "value": "242ab3b514f23ba78260af7788ae023136654b64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581557, "uuid": "f34325c8-b514-4a24-8e4a-72fcf8148cd6", "comment": "Malware payload", "value": "503d43d84f6e56ff6e633d08023b5ec86ebd95eb355f87ad68bf89655b7e37d3d35278362baf9d52934752eb5612e5d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581557, "uuid": "b070d3d8-f3be-4146-bcca-10a4010690d0", "value": "T1FC834B22FE360D17C4C4657A62E74332F2F6478A25BC861A7DB14E8DEF64A4032577A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581557, "uuid": "259b98aa-1bf6-4b13-abf2-d5d0b89af710", "value": "1536:X/CBJN+5Kyc2oQL5K6Zz13iGcDbhtiiVksz5ZtylZQ:XwAKB2oQ9SDdYiqstaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581557, "uuid": "8ac64e8f-bce1-4279-ad71-380f52fc614d", "value": 83108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581557, "uuid": "247d98a9-91cd-4985-8f7f-56cf5fb76504", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581557, "uuid": "d8800aad-1b0c-480d-9103-d0aa95bf3586", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.14868.561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4553ba-f9f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611218, "uuid": "e0941747-ad00-452f-a932-1ec4e7454245", "comment": "Malware payload", "value": "16264c8bbbe55d97bcbfe401a87a3cc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611218, "uuid": "8b79fadd-543f-4b29-a254-c14012f0b8c8", "comment": "Malware payload", "value": "a8647cfb02a8b8c077fb4285357c29f58afb1a8ffff6da199e6a3887030869fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611218, "uuid": "7e263923-f962-4dd4-95cd-7127eba19858", "comment": "Malware payload", "value": "d123ae00c2b877b48a339522d192090126e6be36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611218, "uuid": "adbcf1fe-95c0-4f16-ad20-d0ac3cd16054", "comment": "Malware payload", "value": "2252093cd8316a9494b884071c52120658f5d5970b39160479ae686b699f94277e97787cbb4ed0bc4eccd2543ced8d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611218, "uuid": "18195678-904c-45ae-9611-cb4e9820bce5", "value": "T14126333096F0C438E47711B4452D9339663D7AA11FB1A1CFA2E42AE94B347F9AD3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611218, "uuid": "51c4c7fa-6691-4aee-aa85-ff447bc58a69", "value": "e3cf60b4d5be6f57956398dd6440990e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611218, "uuid": "e4dc6269-4049-45b6-bb29-96fa96313382", "value": "98304:osvPUk14CA3Y6nyp7kxUHFnGHPEVLo/23fSSt4:odk14Rnyp7kxUh0P+LqC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611218, "uuid": "fdcaa655-1fee-4cbc-b238-1c799685371c", "value": 4697640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611218, "uuid": "522a9d7e-5e78-46a7-9638-604d76caa2ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611218, "uuid": "8beaeb9a-4de9-4a0c-bd81-93b732a15715", "value": "16264c8bbbe55d97bcbfe401a87a3cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452755ff-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628603148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603148, "uuid": "5034acd3-c178-4664-a630-8527caf71f57", "comment": "Malware payload (AZORult)", "value": "86bf66df2acbb1fb88db9b38c4dea746", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603148, "uuid": "7db8ce7d-4ef2-4313-9e0c-a0c09cbec24e", "comment": "Malware payload (AZORult)", "value": "a86dd3e06fc22b36fec7d577251ea051b38d02c95608a806895c34119769abf9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603148, "uuid": "f4cadcd3-e9f5-42e6-8dbd-4dd25b13e17b", "comment": "Malware payload (AZORult)", "value": "b67192f0268f1a9f24aa36ee3787f93192ffb194", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603148, "uuid": "d396eb3a-dc6f-423c-9880-0e075e6d8b7b", "comment": "Malware payload (AZORult)", "value": "61f677b7392ca5a7107df50ecd1f53a515b6bd03e87b0bfe536f452c80109b37ad2f392c8c8108f4b0a0ade0e667b7fd", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603148, "uuid": "ef17f65e-0d87-4ec5-84c8-c957afb47512", "value": "T108E4DF1AB394BBA9C0AC8E3B85832544C3F5DD377A32F77B74D436E90A11750861F992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603148, "uuid": "f3f715e5-c090-4d5f-bf49-47f5b886ea5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603148, "uuid": "4da4333c-e720-42ed-8aaa-ffb6dbcc0218", "value": "12288:OpeV3CZrqhwjMLJ2R46pJEq/y6INX6LRgU7e96ptgzMYTmsZHwA+J:mUwQLJ2RHGq/wKgD6goYTfWzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603148, "uuid": "3c0f5cd6-76fd-4818-8991-d0ae438136f5", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603148, "uuid": "65f5eec2-af13-42bd-9204-8b27485e50cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603148, "uuid": "b18578dd-779f-4505-8f83-c2237d4d8e76", "value": "86bf66df2acbb1fb88db9b38c4dea746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa03156-f9d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BankBot)", "timestamp": 1628598173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598173, "uuid": "f9a0ba71-4351-4d81-8644-cd2c0434f8ef", "comment": "Malware payload (BankBot)", "value": "f2979157677fc7d394eebf9274546651", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598173, "uuid": "51a2849d-8da5-4a05-8285-ed5bbc46cc29", "comment": "Malware payload (BankBot)", "value": "a8c9c4f38f72cf8cd3cd819936f1c1ea9670541ded180327f7b096a3370f2186", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598173, "uuid": "304c38b9-277b-4cbf-bf2a-c764552c5f66", "comment": "Malware payload (BankBot)", "value": "d8bab05fb8bb87a72a6fd699b1283d4939242ee8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598173, "uuid": "c1dd2300-d61d-49e8-868f-28c93615a1a8", "comment": "Malware payload (BankBot)", "value": "59f51982c3f01929f29d79b5328e43dde321f50f933b2b525248dd3662f655832879e4de22a389d2cc88e24550e3208a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598173, "uuid": "fb918bf6-f9d1-4fa9-9c39-97184ec7369b", "value": "T14FE533D49DDAE58ADE17DCF18A404474811255C8ECE2D94F4F78720A7C81EE4AB8BF3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598173, "uuid": "b17046da-3154-4bd9-8fcc-6a125af3abc8", "value": "98304:vGYQyg+2RD7fCqx+wDbgHpADqYfanqgDlZIK:vGYTgRK4gJKqYSnvhOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628598173, "uuid": "d9caa185-5275-499d-9481-cce8c3768c04", "value": 3259143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628598173, "uuid": "c6dae7d0-0b27-425d-adf3-68e68f1d606c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598173, "uuid": "eaf79749-3099-4171-b717-044279946ea9", "value": "31706_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab627772-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628560800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560800, "uuid": "42eada25-1a59-4216-9825-2272d0daec95", "comment": "Malware payload (Mirai)", "value": "6b64cc33580bd4aad89f612dbca5a6e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560800, "uuid": "4cd7eb6d-ecb7-4ea6-8084-cfc3352584bf", "comment": "Malware payload (Mirai)", "value": "a915e081dcbeefa3c920ee92e3f625b15b60ff3fb326b46ec9ed68e85ccc4f6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560800, "uuid": "a90c1158-d139-48d9-902f-51f6c4dc3cc2", "comment": "Malware payload (Mirai)", "value": "6e4581baa87192228f1ca3ce839bf6fb38d6472a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560800, "uuid": "b6291e79-ee12-446e-ae3c-61e9c2ad108d", "comment": "Malware payload (Mirai)", "value": "507466cd09a50967214b53d976bdfbe2292b3984ca0f3eb3f64081ef1b7780f3aab9557612dd2620209682416041391c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560800, "uuid": "55e584f5-70aa-4e43-9461-b56edc831c5f", "value": "T1F273C519BF610FB7ECAFCC3749E91B46298C945721943B367934C818F68B25B5AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560800, "uuid": "fafe5147-34c6-4cfb-a1f4-f211a13a21f1", "value": "1536:cJfEFvGQrH19rskjDosdtdT4IROY9lbWZephJT:cqGQrH3rskjDoutVrbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560800, "uuid": "5b14336f-30f2-4c97-b4c8-0701ed6bb4a3", "value": 78244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560800, "uuid": "526cd2f3-2395-4985-abcc-2f2f075070e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560800, "uuid": "9abdc59d-f5cf-4580-a64d-a0caa89d0c2c", "value": "6b64cc33580bd4aad89f612dbca5a6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496cd36a-f9a8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628578674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578674, "uuid": "5ee30ade-037e-4591-baaa-3975e1155778", "comment": "Malware payload (AveMariaRAT)", "value": "474da6264953fb83a0c7ebf5ef12d724", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578674, "uuid": "4f0e2cf4-5dbd-4ddf-87ea-a5fe4c9df2ee", "comment": "Malware payload (AveMariaRAT)", "value": "a9321317116649103debb8a03f5b36ee8b015fa48fc7da5c2b5eb5192dac8233", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578674, "uuid": "d551b738-1531-4f43-beda-72ef62e3e216", "comment": "Malware payload (AveMariaRAT)", "value": "cf9a46bb6daae05eeec53116f53fc44bdf5d810d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578674, "uuid": "e339bc13-3dec-4c05-a64e-d225d671b325", "comment": "Malware payload (AveMariaRAT)", "value": "d8ba0681d0cea592b687b2ff0562fbe7dccce4f8d9dcbb97e849ded97a4dd1d664a259d52f2e53899b1b7de670e4ab60", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578674, "uuid": "aa884029-38a8-45ea-8934-cb68ab852e48", "value": "T15AC50850A3A01107F9F367BA62B5475488ED3C814B69A1CB49850EFAF62D6F37C346B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578674, "uuid": "b1e787bc-44f9-4e7a-a6e0-ab22c2cfd6b5", "value": "02629ecd76c2048962a0358a26c0867d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578674, "uuid": "aff54039-f419-4436-b279-f494e3f13d2d", "value": "12288:QD4a0FisqocEgMHv4FiiEuu5VfCgWLdd7FPza6qfKwZMsudkM0D4pa7+os:hrd/WLdd7FPzkfKugdkML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578674, "uuid": "d975abdb-f838-415c-a166-95b8afe19d51", "value": 2710528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578674, "uuid": "d79cebf7-6c78-49f0-a28e-b79f64048f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578674, "uuid": "30847bd2-b069-446f-80a5-4d3cc00e0655", "value": "Scancopy038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43386c31-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561484, "uuid": "6d5889a0-6207-45cb-8c94-ba1d259ed38c", "comment": "Malware payload (Mirai)", "value": "66c67e6445f33ad0c94f870455be12de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561484, "uuid": "df341923-a0bd-4fed-b7b5-9317c3d056e4", "comment": "Malware payload (Mirai)", "value": "aae64c49ed8402abc29bbc40ae18df60229730a3ebcc18ac3e2db72cb501a42d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561484, "uuid": "7c624839-64b8-4041-96dd-a925f167b110", "comment": "Malware payload (Mirai)", "value": "7bff9319e173930f9555bf81020275fcf25f194b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561484, "uuid": "6fdfcec4-0df9-4291-8edd-bf4e1d4b13d8", "comment": "Malware payload (Mirai)", "value": "dee1a362c929040348aba6a1d5a397f250b30195761649fdd1afd99db1033b3ff851509e712c37945473210cfa2ae310", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561484, "uuid": "0cb1fbc0-f4e7-4ecc-97c5-c2fe59d08e1f", "value": "T1EBD34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561484, "uuid": "f8775d02-996b-4f6d-8fbc-34231af2f604", "value": "3072:f0DvinprSHrDqtVJsB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeJ2JxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561484, "uuid": "4423a653-93ab-4297-9a0e-efce4143dbbf", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561484, "uuid": "ffccd36f-e1fb-4767-b357-cf53e5454a85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561484, "uuid": "023d1f51-acbf-462e-adb8-946b1ee3e317", "value": "66c67e6445f33ad0c94f870455be12de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a752a4-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561458, "uuid": "d752272f-a081-4cc8-a9cc-44907b224d70", "comment": "Malware payload (Mirai)", "value": "9c114d4c3f6f2de0bf34016770d03a88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561458, "uuid": "0ffd67d5-93e5-4486-b807-855a42b0ebf2", "comment": "Malware payload (Mirai)", "value": "ab9f6f900d95d02c8869fbad3787c684be05cb8ed09a39a2f4693e304c3328e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561458, "uuid": "aa95c0b2-cf37-4db9-a3a0-8926b6da5921", "comment": "Malware payload (Mirai)", "value": "a207d012e333263bd4ad3fd750b3a51974e5f767", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561458, "uuid": "9bcb3263-1fd7-4625-afea-a51f3b5f7b70", "comment": "Malware payload (Mirai)", "value": "5937775a3269e4d53497c2d19ae6b2013c65a74a26119a6649c3c33f37c25f855100a66c6c59336c390f9eb033799a66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561458, "uuid": "ed1fb47c-a118-474f-ae73-59d02fb23bb4", "value": "T12E63F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561458, "uuid": "9e7c63b2-1f3c-4725-9b50-9646396f9355", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duEYtX+RZPZk9v0zAIyi+wcauE:TvBkGNxQ6Kb/jKm/kZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561458, "uuid": "1098ce21-ae63-4123-ae15-ff374ea506d0", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561458, "uuid": "9d44908c-1611-4c42-b966-154e1c5a453e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561458, "uuid": "a175ec41-1d72-427f-8278-6550a23c61a3", "value": "9c114d4c3f6f2de0bf34016770d03a88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64215780-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628603630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603630, "uuid": "9ada04e6-447a-4c0d-bb5b-193e047666d0", "comment": "Malware payload (ArkeiStealer)", "value": "898e5d1f1b6d3a39c6273c6fdd891b28", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603630, "uuid": "f57814f9-921d-4146-a3c3-bb318cd48040", "comment": "Malware payload (ArkeiStealer)", "value": "abc7109516e6629fb52d086e176af676ab0c23e289a83b0aeb2bd9b04290b2d6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603630, "uuid": "ac484fe4-2e39-4111-8a59-3c7631b6d583", "comment": "Malware payload (ArkeiStealer)", "value": "179c74f3a2b7652cc170d4a670c2acae3d885690", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603630, "uuid": "0eaab64d-3cf8-40ba-a1c8-dc0de8a1576d", "comment": "Malware payload (ArkeiStealer)", "value": "c2c040f942b7f8baa7d15ed370aa66730dc7369815a5c4fec9f52ab9c5bc5d3c69484b6a1a798ef52a0a7c5b0273bd8b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603630, "uuid": "79c51293-b2a8-40b5-9282-b0b119083c4e", "value": "T178748D30A790C035E4B712FC4ABA93BCA42D7EA1972440CB53E51AEE57347E9AD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603630, "uuid": "f8656678-6c76-472c-b2d8-79309b75b603", "value": "10d590d1f4ed2f9a6fb903cd9f148a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603630, "uuid": "e53ecef6-e534-40c3-aa2c-fd86149d94f6", "value": "6144:2lWcMbtX3xkvlfDYZ+hXTA+OdgpgzSZ97cWwacmunQi:rbtnmGZ+hDnpgmHfwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603630, "uuid": "da6a2728-e1e5-4f9b-845c-ce8ba3f18b7a", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603630, "uuid": "580f7f64-edf5-48e8-8470-ebd185c2d25a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603630, "uuid": "bae1bd04-76da-4312-a9d9-734329d4bfe8", "value": "898e5d1f1b6d3a39c6273c6fdd891b28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b0bc8f-f9ec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628607825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607825, "uuid": "f9117c40-01ad-4c3a-b84e-b79c00f03ea8", "comment": "Malware payload (Alien)", "value": "493b35f8fae4f4d06e36e98082560f4f", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607825, "uuid": "e4c1d5b5-ffef-4eae-9daf-d9494863aa9a", "comment": "Malware payload (Alien)", "value": "ac2cb2c60ede6b43143cf2b98d56932d3f5c97aee0c5f4319e5539203cece079", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607825, "uuid": "1a512579-c37d-493f-b72f-d4b42dbedcbe", "comment": "Malware payload (Alien)", "value": "eff6ed1e028eef7e7d987b6e14c44ac3a828629a", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628607825, "uuid": "4a7a7e16-7a16-453a-bf59-2f068ba1fec9", "comment": "Malware payload (Alien)", "value": "1634b9cb8e3c9e08000800afaf254a049e77575f5781786390c39f4bdc6955fa5263bd5a04b0e7d391aa7ed49b0d76c0", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628607825, "uuid": "53f9b081-bb95-438f-82ce-4fa03798a119", "value": "T177063393E3C2F11AE6D3A8771AC7414BD7E703818D50E60F3651661A487BBC62739CEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628607825, "uuid": "1faec7df-2d13-401d-af0d-bef57d611a8b", "value": "98304:moYHqJY+PhhqidZzR8sD3p3uq/ZAl8lEDw:QEPh8idZV8sD3FTZq6Gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628607825, "uuid": "c4620042-bb20-45f5-bb4e-b85771c561d1", "value": 3768230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628607825, "uuid": "b13ea5b9-d1ab-4770-8d31-3a031ce9a12d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628607825, "uuid": "976881c9-c17b-4859-b9b0-f9b20da4772d", "value": "Chrome571424.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db3934e-f9a1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628575755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575755, "uuid": "a3446a0f-cda9-4865-a961-bdbc9d1c9ee4", "comment": "Malware payload (AgentTesla)", "value": "22ed7b58b0734e8804282a4973c8a236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575755, "uuid": "ab2a1f68-dfa3-490d-ab62-93bbe9ddd43f", "comment": "Malware payload (AgentTesla)", "value": "acb87595a5ea8141149502c5f1616c9f8c38f8a183ce496d638f7ae094c29581", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575755, "uuid": "bfadd79f-2d04-4d36-b316-f38c11d0aee9", "comment": "Malware payload (AgentTesla)", "value": "5c0dbfe944bf5f126f1b49cc3267463c32aae336", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575755, "uuid": "be1ef60d-c153-4fa8-9d08-eeeb5c7b38a9", "comment": "Malware payload (AgentTesla)", "value": "ab7bbee159287b053c140cc6806198f077211171a688647e2dfaeab8c660d9d61790bb9455a8b8939f26ae5cb070300c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575755, "uuid": "ce0b45da-a60a-44d2-bc1f-49ae58ae9b2a", "value": "T16905024B27804383C40AAE7A584963974AB4DED6FFD1EDE53C82793D2DEA341CE06653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575755, "uuid": "80d7ebe8-ef61-4949-9332-2981ea91746f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575755, "uuid": "235c1925-fff6-4dda-b925-5e16d86ae0db", "value": "12288:nqVn3qGaNHEyC9/oR9gy5FHK7zgfFAre3WaEXL5VeX8Bk19+vzR9N0/8sw:ngPp9AR95yAFAe3PEXu8Bk19gR9N0lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628575755, "uuid": "0e4f5630-4488-47c5-b06c-994806941a24", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628575755, "uuid": "c33dad05-9ca3-4809-a684-7f73cc25ad30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575755, "uuid": "3dbc7718-76ff-4b8d-9b39-c890221e3c9c", "value": "Vk6NVzcmOXL1ic5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d452e5-f9d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BankBot)", "timestamp": 1628597860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597860, "uuid": "1e7025ce-f6ee-4076-94c6-cd0ff4534958", "comment": "Malware payload (BankBot)", "value": "716003c3056c3d8483a1fb469596b7d9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597860, "uuid": "1835d268-9231-44f6-b1c4-1c3a2fdab856", "comment": "Malware payload (BankBot)", "value": "adca984304f23557bbab99360a86e331ac018d15c9fbdbcb286c9f7ecf2f53df", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597860, "uuid": "b5cee5de-f2fc-431d-b948-93b0d7d753b0", "comment": "Malware payload (BankBot)", "value": "cee5c812eaec44015c844718e211a162ce497f49", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597860, "uuid": "59bdaf19-4255-4ced-9c33-3d9d91532c58", "comment": "Malware payload (BankBot)", "value": "d36b8b4ff524932f848fb0a42e51f71e26b4114ba25bac216b68d81595f530af7628020a40b195b480782df97e7fe98a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597860, "uuid": "6f085a32-607e-4794-9514-923164535d59", "value": "T10FE53315FB06D406C85BE9B067A4844F90244FA536D9FA4F535133498EF2ECCA393EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597860, "uuid": "2d716063-279f-496d-9401-9abe46a8d0ed", "value": "49152:xKq+vZPoStSYCPXc8Z4jpnauk82apEUhOVZEHcafxYx0MG0fd/D51:xgoStoMBjpnHR2apEBZWc8xYxLhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628597860, "uuid": "2c180382-ca65-4201-998e-51b5a5523a08", "value": 3259143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628597860, "uuid": "cf4dc5dc-c7e9-45c4-a1b0-0c9d8c8e1882", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597860, "uuid": "8cf296fa-b830-48d4-9c65-997596578c69", "value": "01368_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4556ad9e-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556763, "uuid": "d906a0d4-ad2c-41b8-9e5d-07a4c33b0478", "comment": "Malware payload (Gafgyt)", "value": "dfd471b1de761f1a35046f23c123d650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556763, "uuid": "c8827669-aa18-4057-a9ab-97e9b0a292e1", "comment": "Malware payload (Gafgyt)", "value": "adf7d39ba5c5af5ee545a37d329646a4311b6ef7e3ce65c60a6b7524adedb1fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556763, "uuid": "859b1097-1e85-48df-8530-32d261c736bc", "comment": "Malware payload (Gafgyt)", "value": "b0c15b42cc7a78c45b9e4fadf5f4989e74b7227d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556763, "uuid": "e7b57692-7d5d-48fb-810c-126c737f1385", "comment": "Malware payload (Gafgyt)", "value": "6279dc36b9044c280ae198465c946f5545449ff60f1e76285afc88663d6c292969aba0bf8d35ae8bd05833df13e5d649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556763, "uuid": "3e393037-d3d1-4e33-8194-987613b23e77", "value": "T16792D0F5B3E90253EF02C136386FF158D9459DA46617D9C66D421D5F2CE21282E3EE20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556763, "uuid": "e649208d-7ef0-4c47-8562-5f7664075339", "value": "384:MozFfj7NA8M2eBTnR7fj8ByJaUW0MpAc+SO/3+/J14v1RZ:DtjaVpVRv8fL0Mt1SO/6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556763, "uuid": "9f60e310-6fb5-4bb6-8ed6-764c57a7d22b", "value": 19512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556763, "uuid": "63b800e2-0d3a-4bcf-98d0-77a6958feefa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556763, "uuid": "e1385546-3867-4005-b546-7c2742d8cdf4", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.31274.4622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861fdccb-fa03-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628617860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617860, "uuid": "3d4988ef-8fe6-4eeb-b1dc-cbad2daab524", "comment": "Malware payload", "value": "8e71e9516683fb3becd0c6cdf5a9fa64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617860, "uuid": "6abe46fd-8fde-4f9a-a14a-aa1f28e0e80c", "comment": "Malware payload", "value": "adfc1312ed080bcd3fff720269f3c544b5f33194acb71f36b2393d85eeedc34a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617860, "uuid": "641a804b-3939-42f7-9a67-fc0fae8f4370", "comment": "Malware payload", "value": "1f4aa8b7878e19c26e11a9001021975f5c2adca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617860, "uuid": "edc11e6e-8287-4f7d-a066-69effeaf12ae", "comment": "Malware payload", "value": "391274f405d50f900ab99e2f63fd4bf770b3b1b098c4bc0a653861d1a3653faf9d8d2954ca6f72282de7e347a1bac8d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617860, "uuid": "172ed94f-fb8b-48a4-879a-e0d00d521440", "value": "T1CE9423526861AF81CA7B02F294D71EB105B2FD67E222E58902D65EBCB3CF94971700E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617860, "uuid": "c562fd3e-c4bf-48a7-bdc0-01c311ca38ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617860, "uuid": "96851481-c275-4118-ac51-4a660e4823fc", "value": "12288:AH3sPiRmMzP7J55msJ/yU43aOBxijnKtpqRRrrOXpr:Y31mMRXh/yxqOBkj4qRRr6XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628617860, "uuid": "be16fb4e-b1aa-4eb5-b593-b27517671240", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628617860, "uuid": "a1c47ddf-8553-4854-aace-dbefcbe27201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617860, "uuid": "ce19592e-4fae-429a-bf84-1da7ce4f6dc1", "value": "8e71e9516683fb3becd0c6cdf5a9fa64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a17424-f9ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628580955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580955, "uuid": "6488bde4-c891-4680-b43e-c827e190b997", "comment": "Malware payload (Loki)", "value": "d2c6db66473c76df5fc40af64eb4abdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580955, "uuid": "a037a019-ab47-43f7-a115-31d04bc576e6", "comment": "Malware payload (Loki)", "value": "ae3ba262ffc14ea78944dee9331e9336f508b0b283481262ab2ee81b90023bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580955, "uuid": "11dc0c29-fd48-4ae7-a434-542d57b8f031", "comment": "Malware payload (Loki)", "value": "915938e4d1d7e16f1cc92c9b4977ed1f0d5cf31a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628580955, "uuid": "7ad17fc0-e075-43b1-b841-44a367b52c69", "comment": "Malware payload (Loki)", "value": "d780f77d3dfb8bb9fe9dba58541964bab678a4f56897ff4509a5bc3f1c2c67a1d716b33285449f263ea0d6f0cb0a1280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580955, "uuid": "5dd3f2d9-4ad9-415b-ba76-3b82a5bda3f9", "value": "T152340146E8D2236ACD1F3A30907B4C3D45A69D90430ADCF36C8BD8B955A1AFF19F6391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580955, "uuid": "2ccf3c4e-8bbe-4f28-864c-cb86aef3b999", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580955, "uuid": "71c8ddef-a591-4716-919b-4319986348de", "value": "6144:FiXB6Sxquc2iIxvAZgqOWzZBaivEup/t3Z9x6p3:FIfqUhsvuilRZ9xq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628580955, "uuid": "f195a937-8780-4e34-9ad7-d2373e087b5b", "value": 234502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628580955, "uuid": "4cc280c9-8e50-4795-8438-6a9d27549b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628580955, "uuid": "745d701e-9d83-4f73-9287-ba310c343c54", "value": "RQF007421223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6844f7a-f9f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628610694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610694, "uuid": "4ec2b2f5-a34c-481e-bd8e-e006748086c5", "comment": "Malware payload (Loki)", "value": "754cecba9022cd223e85616a62e55048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610694, "uuid": "6d73f4e9-170e-48df-948d-4d4076bfb49d", "comment": "Malware payload (Loki)", "value": "ae5613f24c71abd3b7e9c263bb37eaffab6c4b859e2264709f31e4db88df803d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610694, "uuid": "3edbbe43-144b-4abd-8e08-2498491181b6", "comment": "Malware payload (Loki)", "value": "893ef3f24fc567ceee6c26ffff8ccdb89677e6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628610694, "uuid": "82f818cf-6cd8-4024-88f5-5316205cfd17", "comment": "Malware payload (Loki)", "value": "383d4ac9b133c239053ccc08edc394e77068ff88cec0c3f870ebf8644619b6550e5536ed22be9acc41269c90a3624db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610694, "uuid": "b2d1eae2-f7a1-4edf-adb7-0cd75a50e785", "value": "T1DFE4012236948201D03C17F8486FA1417BF6AE049747D61EBD95F9AE89FF68DC632713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610694, "uuid": "22e0358d-39e9-4730-abac-71b337c94b43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610694, "uuid": "ac258d76-64aa-45a3-8824-2212fcf09a9b", "value": "12288:xEz6HK7zH7vXOXfJG/101DOky96cFNvy2NHSevEPs/i8Y9BWXR:mzpT7f2JGd01V46celpPs/w9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628610694, "uuid": "3d358957-bc9b-4cb9-83cc-663ff11963d8", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628610694, "uuid": "dd13a757-c3da-4b80-b4d1-d07dfbf8cf9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628610694, "uuid": "e395537c-d21b-4bd3-bf8b-100de48692ce", "value": "CTMetals del Per\u00fa S.A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0697f94b-f9e3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628603902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603902, "uuid": "9115d19c-9059-406b-98bd-157f57a98e46", "comment": "Malware payload (RedLineStealer)", "value": "08bbe3c6e05eede66aecff6f708b6ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603902, "uuid": "592a6b37-37fe-4373-af18-0bc6ffba250a", "comment": "Malware payload (RedLineStealer)", "value": "aeb026ea5a445b6c416a9c9b7d14dc1cf0960fff382f3d090af61c1314413bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603902, "uuid": "3ac4fd00-c1b6-4269-a4cd-80f100722f93", "comment": "Malware payload (RedLineStealer)", "value": "3070e95b25b428b40c5e4f2fcf8a1f910ee03b24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603902, "uuid": "b9713bca-ab67-439f-bf42-24bea6af690f", "comment": "Malware payload (RedLineStealer)", "value": "3e4278507127734bf852d43b2ca0107a67cada3282c787f3dc74c811fc67cc30f99ad301b9fb77f4ab81c2f392978a6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603902, "uuid": "86c554ae-85b0-43a6-a714-51a8632b1fe2", "value": "T1AA64CF307660F872F0A74670749DCBA4F67AB8A1AB58424337953E2F6E333D06369359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603902, "uuid": "58cae77b-675d-4b98-b909-81003c25c043", "value": "e4e1e1e6e225074b287b0f65b50fbc7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603902, "uuid": "f891f823-5af3-44ea-84e6-660602144b11", "value": "3072:N8SrkuT/o5SwMbvonnbV59vjbIOPTk8y/vZJv/2Hly+f/Cd5Ow7YWnb886IlnCNl:R//g1Nvy8UvZJX2Fyy6+bWYKlCIwY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603902, "uuid": "db5626cf-d7cd-4514-9a18-5ee76a6104d7", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603902, "uuid": "bdfdbd07-8598-431f-badb-d2e3593d45e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603902, "uuid": "eb57f941-1bf7-44b6-9973-fe28afc0f048", "value": "08bbe3c6e05eede66aecff6f708b6ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d1416d-f9e5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628605089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605089, "uuid": "5cd3b700-d837-4dfb-90fe-5607d54fa22e", "comment": "Malware payload (SnakeKeylogger)", "value": "a82c79fde94745923161d70e357087af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605089, "uuid": "6344d26d-2412-4db3-a417-a0bb60e9f962", "comment": "Malware payload (SnakeKeylogger)", "value": "af5672497085dd27560917db1b83a913296d5335f898351a0eeab452644af109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605089, "uuid": "9a4f8975-7b80-4692-9d72-41b4171343a4", "comment": "Malware payload (SnakeKeylogger)", "value": "71cae27fb4a10eab6c50dedb02d625d80596a540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605089, "uuid": "c190be87-058b-48dd-b7d8-ba282182af8f", "comment": "Malware payload (SnakeKeylogger)", "value": "d036529b37df5c956c3a99ac138638788cf09f97983f914e770948312aea56e6b28b4f597caea1dcb336e9ac5d4dfc17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605089, "uuid": "67d46c2c-c767-46e2-a3f4-e30b85dd868a", "value": "T14CF4BE25F22B9714DCB4C3FB185892606BB9BCE9721ACB395E54B0FDB87363826D0741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605089, "uuid": "37db9c96-f37f-41df-b415-72dcdd6a9664", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605089, "uuid": "0784bce3-0c63-4e75-854c-c5058363e09c", "value": "12288:6sroE0DGsAqEFjc7q5yxww3jC6gYEQoWmi/EQyaUVKnp:OEuGdnqAyxP3GiEhWmi/Oahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605089, "uuid": "0118ae27-ac69-4144-bf4f-ba24dd863540", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605089, "uuid": "c5d44c4f-5405-44df-8437-e8625e1807ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605089, "uuid": "7662b2a7-7d95-4ea3-aac6-b5ba98f56c92", "value": "pago ref210721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cdb7ec-fa32-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628638044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628638044, "uuid": "9f6dd350-867e-4508-961c-7ab2f630b789", "comment": "Malware payload", "value": "19f9640267ade9a59b1a6144a6a19543", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628638044, "uuid": "142f24d8-2e89-487a-9604-65e8ac94f37c", "comment": "Malware payload", "value": "afad3ba9767ab9d2487ca4972286c1d81f550e40fbaad2a123206efafe0b223b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628638044, "uuid": "8d229862-ce0a-4e57-a6d9-cf2d21f7c599", "comment": "Malware payload", "value": "c2fce198f408f9434b25e8b5386ef5f996e4b64b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628638044, "uuid": "1353763a-560c-4281-845c-88ccf5958f7d", "comment": "Malware payload", "value": "9613cb887e540ef7b6050124f30219b540f4098f9e67c60dab0061b49512592b288ff2667391b81c43a37cb57ac9f021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628638044, "uuid": "8ae46d02-8af7-4782-9e59-0c67157d9a18", "value": "T1F2144B1B5B42A701C51586F5B492C6ECC2AA0C7DDADB9F5EB4C4FA2CCDB306196223C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628638044, "uuid": "1de541d1-d28f-44bd-863a-afff2222aba6", "value": "8d2e8ab0a538cfdaef668267924ba684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628638044, "uuid": "c0481fdd-7582-4c0d-95d0-5f6c236a6d8a", "value": "3072:XhP16R/9RvS6WZlciK8Pcm0CdMz526RfjFNgegWNHDSb:Xhg/9R9SXd05VNg9WNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628638044, "uuid": "1d4bc20d-58b6-4cf9-8421-f96f155872d1", "value": 192144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628638044, "uuid": "60c5b607-6f23-45af-b313-e9a837e5ff5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628638044, "uuid": "e95e73fa-3534-4594-8b9d-d24709759c87", "value": "19f9640267ade9a59b1a6144a6a19543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173c06bf-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Heodo)", "timestamp": 1628556686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556686, "uuid": "92c5f4fa-bee3-48b0-8a75-3cd32877aa92", "comment": "Malware payload (Heodo)", "value": "79f576500b1cccad9153c20e6867113b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556686, "uuid": "2a967880-1fa2-4fb6-8b46-fc2c1ae5a5ac", "comment": "Malware payload (Heodo)", "value": "afc5327b0243d34ef6b010802a517549e124a29aee025a59b7ea56fac3489e98", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556686, "uuid": "107a0d89-1db8-4805-807c-5d0c8ff84283", "comment": "Malware payload (Heodo)", "value": "f55c1e615fcd862479b4604a7aff85da117f3af0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556686, "uuid": "ecfcb0fe-8ea6-4421-9779-0054a4f5b179", "comment": "Malware payload (Heodo)", "value": "360cec7a799de72080ba0651bf87653481fcbac09aa789b27ef3b592bbf0a7894c2e68542cf1ff852614d3be81006c7e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556686, "uuid": "43b3b821-0d95-4218-a82d-ad4b867f441c", "value": "T1AB56339A43B5B960E7771A700CC62FDCB9C31DE6866639FEA52C1E21BF7644020D36A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556686, "uuid": "9562e18a-ffd8-417d-8580-9e8d11186081", "value": "196608:lY4GjnVKrYiyLYdN5WqfiVXhorj+Nzdd6TpQ:lY4GjnAXyL2e6/kf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556686, "uuid": "41c95966-8cce-4fd6-b569-b86a197f754e", "value": 6446080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556686, "uuid": "af380242-cc9f-4622-953f-4ba0b1bf09be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556686, "uuid": "b61fd272-db81-4504-977d-2dcccfdbe213", "value": "PAGO_FOT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4988ed-f9e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628605279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605279, "uuid": "637e7387-506a-41f1-adc9-6ded1d5dd951", "comment": "Malware payload (ArkeiStealer)", "value": "9b0c44a5a2a4475547a8a5d03889a167", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605279, "uuid": "f8d821d4-7eea-4650-b526-4771d097498b", "comment": "Malware payload (ArkeiStealer)", "value": "b184aed51e28a42979f25172db1f3a91567ee7bc74a8af25ae296a5b833ad573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605279, "uuid": "58b6fe20-77b8-443d-a76a-c45502bc5081", "comment": "Malware payload (ArkeiStealer)", "value": "8be915742f0028d7b39bf88d342d71a4043d4875", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605279, "uuid": "557ae177-2ccc-4d4f-bf99-ee958e33aadf", "comment": "Malware payload (ArkeiStealer)", "value": "2d92ebdaf3824bb77e062a143d40d79900267e4e2f965064973fcd89689df92c7531ebe88242788f0bc1d0dafe65a101", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605279, "uuid": "ffa1011e-9b3f-4d25-8763-07ee7c8ab32c", "value": "T1B4E4E030B690C034E4F712FC45BA837CB92D3EA19B3451CF92E51AE95624AF8AD31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605279, "uuid": "327d0176-46d8-4490-bc9b-0aad5cf05a70", "value": "9e69c87bb37519c7f1f7d4ff41d9c1a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605279, "uuid": "7a3f799a-7a42-4fd8-a012-9d9e4c923b34", "value": "12288:SCh1li2Egna94e8NdC5QtGkUl9z3t2x0DwS/5Bi+hl:/DvEgzC5QtG9btnDwS/5Bis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605279, "uuid": "dadd5b49-83ec-41dc-ab1a-cb50ab901baa", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605279, "uuid": "dbadd47c-ab30-433a-b2f2-f74a0be16a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605279, "uuid": "aa470135-066c-4930-a700-9ed3ed76929e", "value": "9b0c44a5a2a4475547a8a5d03889a167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf2ed99-f9f3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611000, "uuid": "33f5e05d-0f3e-48c6-af94-c27fe21ef88f", "comment": "Malware payload", "value": "a910d26af2139ed9070774f36fa9bb06", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611000, "uuid": "acc038b4-6c72-4b4e-9b6d-f8b45c99e62f", "comment": "Malware payload", "value": "b40b9bf089b84e75979dc53905461793890f79bee528f123b594c22085e213b6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611000, "uuid": "99e20e45-cc64-42c3-9d35-479fc8e1278e", "comment": "Malware payload", "value": "817d6a8a2e8f846c980963a5fb37c6e06c7b30e3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611000, "uuid": "bc4c5091-bbd2-4068-ad81-ee3d4b051581", "comment": "Malware payload", "value": "26f98606c5daec6fd1f9d6fc55874528d4c5d37139cf73e71e19ede5299da0664b89c360ab085d06fed5a20157169d93", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611000, "uuid": "ca23ec4d-20dc-4eff-b127-4b937e76f5ce", "value": "T14ED302E75741A8FCE2F9093596F9277A373BCE20A8A15F9F04254B618E5720A1F31D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611000, "uuid": "f9979a03-de5b-41b4-8d7d-f5f61f566948", "value": "3072:CiM5eROwXw442uc1oIfFSUSX4rqEq/JOmJOV8d8SwA4z4wA4z8UlvDm8eUlvDm8y:CX5eROsXw8fznrqEqQXCarA4z1A4zPvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611000, "uuid": "aa671ca6-b1a1-4536-8e3b-ba0c16d6f65e", "value": 139584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611000, "uuid": "a582c5ff-9113-4720-855a-e94c419090a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611000, "uuid": "251359ba-1516-447e-9327-da5aec99d802", "value": "AndroidGuncelem.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171a807-f9df-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628602256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602256, "uuid": "9f020161-1a53-42b0-9102-92a2daf335e3", "comment": "Malware payload (BitRAT)", "value": "31db72bcc1cd98d69e9b91a63b061c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602256, "uuid": "4a1c3325-3004-49af-87c1-aeb38b5db405", "comment": "Malware payload (BitRAT)", "value": "b610d1ae855f79028cabdbd3c1160bc330ef68a7f30ab5544d00b09af341cc68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602256, "uuid": "bfea4264-752a-480a-966e-3c2363dda0e3", "comment": "Malware payload (BitRAT)", "value": "c84563b56088acb3c1bd9435bb264576509285a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628602256, "uuid": "c21ca800-9bd4-4d00-a0e2-93593d690176", "comment": "Malware payload (BitRAT)", "value": "448c6e0377984b4c997d377563648bab9670bcd1c4724e7eeec4430f422d70c91f624df23e62274b622c8fc1976b84fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602256, "uuid": "0a51a898-25fe-4bd4-b33f-b5ae4e8829de", "value": "T1236533E01A1ED33EF65BCC7C7AAA0D03CD79D162666B05057E6CC47D20FFA912948CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602256, "uuid": "0559dc3e-64a6-4136-a4d5-e0520e380f25", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602256, "uuid": "3b551009-1a0d-44cc-8e99-4666cd4cc8c5", "value": "24576:DndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzgZ3y9uunqP:LXDFBU2iIBb0xY/6sUYY5ZC9n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628602256, "uuid": "ab1ec06b-a789-4644-9edc-ef2971d30926", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628602256, "uuid": "41c4488f-2116-4c16-ad60-8ed9f1071edf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628602256, "uuid": "bf8b2796-0b31-4a3c-86c1-b0bb4bda88aa", "value": "31db72bcc1cd98d69e9b91a63b061c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95475c7-f9f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611477, "uuid": "7f33bb7f-9f6b-42d1-81b5-a9318971e0b4", "comment": "Malware payload", "value": "6a07df8810ab9c4141ad36279d406b96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611477, "uuid": "3e126e7c-5874-4156-be27-10f47e7539cc", "comment": "Malware payload", "value": "b6df7c082c500ca77f9530f0b6954d6d8d997ff3565bd2be5f18d3363d50d7e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611477, "uuid": "15bf223d-b6f1-4f57-b799-61837d2a52b2", "comment": "Malware payload", "value": "dfb0108fdc4ccb0fb10090a51ef1685f6efc0b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611477, "uuid": "12e910f6-ad0b-4bf3-a4df-409803420960", "comment": "Malware payload", "value": "adc07392405e0ac19db669ab8dc6aed00ea3793620194f51de9b7090ca33a95795b0f3a2bc1419be1042eeda4ee14223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611477, "uuid": "3a4b2177-d341-45ab-b649-3975233dec8c", "value": "T1F1E4230A7C5852CAE4F042B31C95D43F17B2AC73E623C0AAA4F59FD53B937A685C8615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611477, "uuid": "c8e0f0f0-3613-45b9-a63a-475e8b2a702c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611477, "uuid": "4ea7254a-1c4c-483e-b230-8dc8bd64aadf", "value": "12288:bUQDjg+65t+UW19qnOVPLQz3qeeitZJ9xrhNgL+H6IBOjwPeMK:bnyWPxVPLlzI1rhqyJUWeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611477, "uuid": "4c9c4e21-7960-4758-a1d3-eb8ecc36e99d", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611477, "uuid": "f2a30b90-5baa-42f8-ad11-db18e3d1110a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611477, "uuid": "bf65ff34-cf15-46d4-b971-4bc35257c087", "value": "6a07df8810ab9c4141ad36279d406b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52ac49a-fa06-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619308, "uuid": "0e35da25-2f60-41f7-a66f-67576e6bca09", "comment": "Malware payload", "value": "1ada72872116c80f8e206b52171a4c87", "object_relation": "md5", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619308, "uuid": "b9ada3b4-c50d-49ab-9f45-b30d3d5dabc9", "comment": "Malware payload", "value": "b7811339393ce8673e5e4aa628d672c501b51b0a947c2106dfccc0980b304276", "object_relation": "sha256", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619308, "uuid": "0dbb685b-5178-4501-830b-a982b8f48e23", "comment": "Malware payload", "value": "51d543655a53d34e16a622d68380f74c56cc23d0", "object_relation": "sha1", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619308, "uuid": "ec518196-e557-4be0-94c8-dfa7c3b0cd4d", "comment": "Malware payload", "value": "57c80579e927f5ab4373ea23196141863ad1bbe21f39514b9f33b83ac2a203f1521eaaa8a83598fc26a2d39341ad6410", "object_relation": "sha3-384", "Tag": [ { "name": "ESET spol. s r.o.", "colour": "#919905", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619308, "uuid": "4832ca06-5db2-4466-9f3f-2dffd5944e1f", "value": "T14E352384315E00E1FE6585359BFFC27A1FB0FC694BD1824F35A176492AB6BE06A33613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619308, "uuid": "00be8be2-f573-4341-a4e3-1e39c5212d66", "value": "1c787c0721693fe2dc6f1e09e0da27bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619308, "uuid": "b922344f-32b5-4a53-bb0f-dd0bd5ba825c", "value": "24576:9h110gG8YO2eSxs3v4LrH8J3UuO6KzR7sq+fwQnQeSfbi:Z1y88eSxs4HcoMq+B0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619308, "uuid": "df2cb65b-42e9-4b10-8528-dc24a0ba20c9", "value": 1141840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619308, "uuid": "27cf7190-203b-4ece-ba0a-ca618bb83f25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619308, "uuid": "921b5799-d279-411f-9110-d366f84e8b20", "value": "b7811339393ce8673e5e4aa628d672c501b51b0a947c2106dfccc0980b304276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d716c1-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628600703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600703, "uuid": "bd42a2bb-181e-41ed-a569-b17fc9dd6e18", "comment": "Malware payload (SnakeKeylogger)", "value": "083083666b8d28b06db9bc17ea30e524", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600703, "uuid": "7fb56f4a-dfe9-408e-815b-ac77d0534868", "comment": "Malware payload (SnakeKeylogger)", "value": "b873313c6856102fb8f7cdb84be0220f514610fc101f0dfc99282e5b162d6669", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600703, "uuid": "8e88b6d6-1d8a-492c-acd1-856182ee672f", "comment": "Malware payload (SnakeKeylogger)", "value": "9299438a48d944f22f729a95411a57bee9e1a23c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600703, "uuid": "23340e66-e254-4d96-bb65-42d3ee60098e", "comment": "Malware payload (SnakeKeylogger)", "value": "a8800a891aaa638184dfa75b811d096fd861b6c34a66a49eba9c4444129eb1c2175004983501d3f206f6f627b771ed21", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600703, "uuid": "185bc84d-907e-4c85-96d9-6a2066efdcca", "value": "T1E24370BDD45306988F86ABB86B1B5F45028CB66EFB859572323C977467E2D3B401383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600703, "uuid": "3a24561b-b3c5-4958-ba61-a1664129be8a", "value": "384:ynMFut+FgIwuKD0poVeSvHWct0UNcipDJ/FLN:ynua+FvikPYWcJ+ipB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600703, "uuid": "2b819001-eefa-42e7-9de7-b1897c710f27", "value": 60132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600703, "uuid": "9998bcef-e5d1-490a-9d50-78d7b5ae72e2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600703, "uuid": "7743b1c1-c7f6-469e-b16e-6f4e9414230e", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17ab79a-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628608538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608538, "uuid": "e36175ea-a952-478f-8d05-951f631bc44b", "comment": "Malware payload (Alien)", "value": "f27a16156566dd59fda402c3ce5d0928", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608538, "uuid": "ac0afb41-3f8a-444c-bd34-abf40b870c44", "comment": "Malware payload (Alien)", "value": "b89349f430d4afe1900adcde123f11289abf2734588f5deaea856b46f503fce7", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608538, "uuid": "35bb5a0d-8881-4902-953b-7056fc2f8c08", "comment": "Malware payload (Alien)", "value": "16740f3e982c81da27a2594ffe716c0e89752d4a", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608538, "uuid": "2acf28b1-d573-4765-9ead-1ba4e9217d23", "comment": "Malware payload (Alien)", "value": "d91e90a71dc9efa0e092e686039fc6a9d79dca5a79321243de0300b4d35899694376d57aaace45c7c9c9f999ccef2d6e", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608538, "uuid": "d0e1041a-8a17-4a6c-a23b-62a8f16601d9", "value": "T195E533ABAF8382C5CE178230A1426153BD751A744ED2E83F4532887768FBAB84357C7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608538, "uuid": "975dcd3f-3a33-4bcc-87b0-eff47f8af6b2", "value": "98304:GHBqtoCNpM+3xwijLqoeIq6aIbAJtB9+Yeu:GHBrkv3xwiaoezZP+Yeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608538, "uuid": "eb4cafc6-646d-49f9-9a46-952b0fe1f495", "value": 3222025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608538, "uuid": "14093951-d0ec-4bfe-a0c7-0e602b6f0b4c", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608538, "uuid": "09a88d31-ee0b-4503-8e46-8db8f9e750f7", "value": "YERLI_IFSA_GIZLI_CEKIM.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c200e3-f9bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628588738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588738, "uuid": "f5c41c0d-4ce6-4d52-b3a8-b944c9652fc2", "comment": "Malware payload (GuLoader)", "value": "31af6d34827c7255b7b69370a9dae461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588738, "uuid": "dec84ae3-9b62-44a0-8850-0399532f69c9", "comment": "Malware payload (GuLoader)", "value": "ba0751d8b1ccba23fce33d31e5f8ecf75af336cac86b5ae1d2c4306d53cd148c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588738, "uuid": "59ca3952-0e2a-4d48-9814-589f4536f428", "comment": "Malware payload (GuLoader)", "value": "2a5b9d10f3d688a05af277f880ffb557c1df3d48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588738, "uuid": "07b30c4f-3936-46a3-b6ff-b98aae1f2ebd", "comment": "Malware payload (GuLoader)", "value": "1d11cf7e7d4195cbb524e084a0a73439ee9f10503b197f7e52860c8d193ea8124db44a4566fff52bc0ed22798a585da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588738, "uuid": "67b8ff9a-a7ab-42b9-9f38-4213f1b66166", "value": "T1A3C38DD1FB908C67D66A15F214B31F55C8686EE0142A8F8391DA0E2C6FDBB03A7241DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588738, "uuid": "d83d3e75-e6ea-4012-8200-633994ac8db2", "value": "55eea43da7f3c7829cddd95897d8aea4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588738, "uuid": "e0844a2d-e21e-4780-a8ca-2c9974e11bfd", "value": "1536:Ir53Hu4ybtrnlwZTTqrT66r/+Jc/RjootGf/XxsgUK23u2KyIedrPRAo3HcJ:I2tblSsT66iCiJf/KgUK2efyI+1ARJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628588738, "uuid": "9eb5e98c-ca22-4062-a57c-f31802fcca45", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628588738, "uuid": "f4a7a778-b993-4396-b5c0-ab4bbaf9c6c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588738, "uuid": "79a1195f-21f8-4bc1-b882-b76618e4ff59", "value": "SOLICITUD DE OFERTA PEDIDO n\u00ba 1202135489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b13826-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628585084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585084, "uuid": "6147cf3f-c46b-4bbf-9448-ce5d452d0162", "comment": "Malware payload (AgentTesla)", "value": "bd65b6f625a29dcf2f8ee0508fd0e49e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585084, "uuid": "95b289b2-872e-4ba6-b035-d4c1df90eaf1", "comment": "Malware payload (AgentTesla)", "value": "ba4541e570d270663cce5d1f51103fe77c915922b67f4aa0c05b10abe169aaeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585084, "uuid": "4900a2cb-e311-468f-a42b-fec64879fa71", "comment": "Malware payload (AgentTesla)", "value": "afdb576fc050ecb1261f7db11deadbd13bd97e5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585084, "uuid": "daf63a21-d84b-4859-8d95-0e71c24d0f60", "comment": "Malware payload (AgentTesla)", "value": "4c97ec6ed20c1bd1474a4aed1e444279d2fca612781831f8520f05bc757df49d6a894e5224aac70dcc26cd0916ef9df1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585084, "uuid": "075fd784-942b-406f-933b-156b21450cce", "value": "T1A105F1A57781BB8EC17F4E75C4418800DBE4E6B3A703F7C72CE215E85D8E68A4B63652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585084, "uuid": "54f67ebc-b4ce-40a6-9895-0df25d80d00d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585084, "uuid": "1d8f1ee4-e514-4f89-ad8b-b9d304f9bc4a", "value": "24576:XG492MbZkCot8eh4AShJ0qa/0Um3mKi0b:XNkC2CM8SEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585084, "uuid": "2a7cc10e-4954-4c93-8cde-4c70be0bab01", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585084, "uuid": "22914ad2-94cf-4302-9bf8-18315f3174fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585084, "uuid": "27422073-b01b-43e1-a2f9-1873db3a31f5", "value": "bd65b6f625a29dcf2f8ee0508fd0e49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0a3847-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561447, "uuid": "dba92174-7c49-443b-9419-6bb55b959b97", "comment": "Malware payload (Gafgyt)", "value": "8428ad658e31dc204aa67ea8aedc9aac", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561447, "uuid": "6b82b7a3-eef6-4dd5-906a-4ce5caab99f2", "comment": "Malware payload (Gafgyt)", "value": "baafc5dac1d30f95cdd016dd1a341670f26ff3e355f7415bcfcf3dfa50476df1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561447, "uuid": "ede99d50-564d-4ff1-8a79-5d18b6cb0111", "comment": "Malware payload (Gafgyt)", "value": "f01858639beb30f0c0272b6287074f4f963a2a72", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561447, "uuid": "b7da8b0a-8b3b-458d-b2d4-7c269f0b9489", "comment": "Malware payload (Gafgyt)", "value": "6502e30c96a551836aa2203b1650f73f22be52e3ede9e05962f44a9cc5b8c032b937cb7d58bb0db9c27c8ce6c9ccbcbe", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561447, "uuid": "c8222ecb-e5d5-45a8-a25c-dc9794be4367", "value": "T195B32B27F691CBBEC08792B426CF9D919833F1FD1766322B33A46DB42B194C62D19E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561447, "uuid": "ec3f9005-a7a0-4044-a93a-8316102c785f", "value": "3072:LyoFnyjczarP3Dpa1NDZDFhzOiK+RmXZuJXQEFJZgQe:2trP3FyFhzOiBmXZuJXPFJZgQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561447, "uuid": "941c8bc9-57f6-4b0e-ba42-c8519ebfe932", "value": 114136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561447, "uuid": "0fe125ea-19f9-4adb-b114-0852b3a09bf6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561447, "uuid": "21c1f34b-15ba-47b7-b161-93b14fc93d67", "value": "8428ad658e31dc204aa67ea8aedc9aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b001b8a-fa03-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628617868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617868, "uuid": "77d730af-238e-4da0-886b-1a0af5ae1a1b", "comment": "Malware payload", "value": "aeb64eb2a6f01a3102aa9b4d8e6ec148", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617868, "uuid": "ff0323e2-57d5-42a6-a5e1-978a07c0d003", "comment": "Malware payload", "value": "bae32b579c2bb3d0f49b9fefabd433b5cfa3a398bd9f49b675fc628a352eeb44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617868, "uuid": "335e2a98-818e-47c8-b29f-fbb6b037ddc8", "comment": "Malware payload", "value": "c3841970b7fd0e3cb1deb6422423d3a86da793f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617868, "uuid": "50355fce-dc60-4c60-ad1a-9a499cb9e8d5", "comment": "Malware payload", "value": "3085c8c75161a2c50af6237e7c41529343fcb4c9a8af67353056219c3eca073dff0a801335e5cff3dd4ebbc5c43b05d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617868, "uuid": "4f857e43-4e41-4475-9c1d-c946e66209d5", "value": "T1BF94232133E417F2D16C5FB759C2B831072EBD8EC862F90A19DC4D5EBA3671787A2606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617868, "uuid": "4b0e1916-1581-4bb1-b4bd-2e588faba53b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617868, "uuid": "4c0b62c8-b89f-4dc3-83bd-7b0f82407525", "value": "6144:0qWlspsQw0xAcNMoFE9yaUThi3vpV7KyQiMDga0O3kRDpqpF24BwOjx5heO:HWlDl0UqXc7KyUDN0UYDpQFz3jxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628617868, "uuid": "918651e4-05b3-4b93-996b-f32577200f67", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628617868, "uuid": "97f6cf65-4f17-41f4-89f7-6953c393e8fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617868, "uuid": "1b87646a-4860-494b-81dd-4afb4ea4a6b9", "value": "aeb64eb2a6f01a3102aa9b4d8e6ec148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bf0fed-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (VegaLocker)", "timestamp": 1628577804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577804, "uuid": "5ce05ed2-42ce-4375-8e21-d32efdfa58a7", "comment": "Malware payload (VegaLocker)", "value": "5722cc13cc4d2f58cbc35fa38d33a208", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577804, "uuid": "bbf35e08-e8b9-46bf-aaf5-d4bc81349e7d", "comment": "Malware payload (VegaLocker)", "value": "bb96e1541b8ff33e5ff71c2d4298019f815a93a5c5f84d46197212784f5ef804", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577804, "uuid": "c117a5a6-265d-4bfa-bb53-e8ae53c314fb", "comment": "Malware payload (VegaLocker)", "value": "431326c4fd9f62457f56aa6e9a0ee86c9fe5b7f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577804, "uuid": "bb469e92-34e8-49d7-8f65-903df04b3ac7", "comment": "Malware payload (VegaLocker)", "value": "2d88815f03c1a15d8c39363d03c87805ae35bef8288d5bd78273924a51a7f64c3c59dd017ecb3c873ffa4a28ad54ce2a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577804, "uuid": "ed565193-eb82-484f-9b2d-d58b7aa93b76", "value": "T1A2E4BF50EA0411165E8353ABAC1362D2BD3DD01193402269E99E939C7B479ECD3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577804, "uuid": "becdaa37-92fb-4a62-b5c1-96f1d65082f4", "value": "12288:V1j1kArb88/ftkN0Pbyoy9qzP8yF6+MPe2EUI9:aArbrV40Peoy0zP3eW249", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577804, "uuid": "9a8f912a-1f1b-4226-a43d-10148849babc", "value": 719854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577804, "uuid": "d71341de-5042-443f-9b78-3659a870ebc7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577804, "uuid": "2e026af0-6452-4b9a-811a-c9662de6a8fb", "value": "2988.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad20c7c-f9a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628579133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628579133, "uuid": "4f980b70-e514-4edd-8335-4f64bd082ba4", "comment": "Malware payload (SnakeKeylogger)", "value": "c5af54622602c908d5af6c3d8d7bdb09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628579133, "uuid": "192ef6a7-b50e-435f-8655-a5badfc24284", "comment": "Malware payload (SnakeKeylogger)", "value": "bbeac700ec88ce4b23f0bb5c996effc1586ef0e7802bc18695ecd3845a2a0022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628579133, "uuid": "e3a1dbe7-3880-4587-82e8-82f3fdd1777e", "comment": "Malware payload (SnakeKeylogger)", "value": "67fbbcaef7c841afc2af6cda2740b3f934cd9c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628579133, "uuid": "1c7c9ed5-309e-42b4-aab2-dab1ee2d7b0c", "comment": "Malware payload (SnakeKeylogger)", "value": "b409cf782790c33b23f2c54a38d7c691537e3dd4ee5518ee916b9783e1c9b5fdd5b9f74bc902ab3c236aaeb1665ce4fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628579133, "uuid": "e444e151-f2b7-4ba4-ab2b-5c6f7d9a8f2f", "value": "T10605014B22806793C425AB374CA993920B75EDD5DFA2D9ED7886392E1EF3741CE02713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628579133, "uuid": "c91f1960-be52-43e0-b859-7abd97e9a2ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628579133, "uuid": "8efc4ac5-8a2f-4e44-b5fe-70f14ef8f716", "value": "24576:5vVPp9AR95STVO0NF64RWPOyvzQ6bnVOGeuo8:5vVPpKRSs0KBOybx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628579133, "uuid": "2d2ee239-a10f-4a64-a499-7a085b754489", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628579133, "uuid": "2e01b556-c96a-4bb2-9b11-b11d9fc43de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628579133, "uuid": "a197a8df-4d6c-46f6-871d-8939153a2ddf", "value": "SecuriteInfo.com.Scr.Malcodegdn30.21285.16823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce433b3-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628574304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574304, "uuid": "292a309d-4425-4a3e-8ca5-13b8d0b25d5c", "comment": "Malware payload", "value": "47865edbea4567c9795b1c49cd4c78ca", "object_relation": "md5", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574304, "uuid": "a9ef9fd6-1e70-4a18-b9c7-e58603743751", "comment": "Malware payload", "value": "bca3013b394c19fdaa8146c3097d44dfaeaaab726d6653e75ff3ec406a6c9a43", "object_relation": "sha256", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574304, "uuid": "ba3f1d90-3653-4d01-ba60-4620aeed8e08", "comment": "Malware payload", "value": "0dddbd3098ffaf00393578f5561ecb09001142be", "object_relation": "sha1", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574304, "uuid": "9b9ef56b-0f3a-465c-b0f6-364c0aa82925", "comment": "Malware payload", "value": "e3083d174c10061ea05f233e43f92c46c512c93f34409d96689ea1826c7b32c8051f807527c671df396a6e5657a7b59e", "object_relation": "sha3-384", "Tag": [ { "name": "vst", "colour": "#0CA295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574304, "uuid": "cf53fd0d-26f0-4294-97a1-25e82833db69", "value": "T14835A5582923B8CA864D699F6172BDC52E764B3FE65B06497079CF0CC057B880BE0DDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574304, "uuid": "53d6f179-2a8a-4b8c-905c-e3291daf001c", "value": "12288:n6RGVFgDSHmvL7KpUgJHTPPg1I1CXGmhwb2PgbOt9VN/u:nekyNbGDyoOtLN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574304, "uuid": "cf988c74-6c78-4aa1-bcb8-53431867c645", "value": 1091468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574304, "uuid": "91b86f8e-1fc9-4226-9786-c5694eaa36a9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574304, "uuid": "a956f88c-848e-44ea-9fa6-1e55ae50284e", "value": "Portartela.vst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628b6573-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628561107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561107, "uuid": "3d5838f2-b9b4-461c-a2aa-34175cc619fe", "comment": "Malware payload (Mirai)", "value": "3241cd6405d3af1fbd36fe5c6352be5b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561107, "uuid": "2d27d281-c20f-4034-872f-2d2fdd97f3a1", "comment": "Malware payload (Mirai)", "value": "bca3cfa5df7d7e810ff869221ef87a69d6b42f6955c9da27c8946c79909c1696", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561107, "uuid": "1fbc712c-634f-4228-b3cc-4095f61ee6e3", "comment": "Malware payload (Mirai)", "value": "c8795ef79b609f90e4e48c8274ba63d414a00bb7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561107, "uuid": "0836edb8-7651-490a-be28-743092d27846", "comment": "Malware payload (Mirai)", "value": "91dc7ba1c709d811084b171556cb59a113b9e4380912e6e32cb0a8e7b9fb6b13e1be3e3c74e2a8109d1d99e756d8afe4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561107, "uuid": "125be357-9dd6-4270-baf2-de6e7e9a641b", "value": "T1AD530847B44180FDC149D03443AB6A76C8237EBD1B3AF39637D8EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561107, "uuid": "af78c6b9-570f-4f97-a93b-43f45395c461", "value": "1536:anF9U0FferGtOW4/RWo4fz8kkRqwNhJOlQ5M7WR:0FK0UrUO3JWviRqwNOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561107, "uuid": "3b27c19d-874c-4dd6-a646-a3933c97aee5", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561107, "uuid": "f6b9c9dc-8313-46ce-b14c-09e37f8a33d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561107, "uuid": "964a1a74-d03f-4ebe-8766-9b62099156a8", "value": "3241cd6405d3af1fbd36fe5c6352be5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7c2d1d-f989-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628565638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628565638, "uuid": "64993af3-6cf2-4ebc-9743-c578fc27c419", "comment": "Malware payload (NetWire)", "value": "99693f2f6c85421734381a0957f5e382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628565638, "uuid": "1bc15b6c-d2cc-4cc9-8b33-d1d8a3d70dfd", "comment": "Malware payload (NetWire)", "value": "bdf2ac2fd9106e36b071409e48ba9c1996c4b987b6d28e6baf70046316d27c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628565638, "uuid": "0fe19415-021f-4a81-81a0-b8be6cf8cc89", "comment": "Malware payload (NetWire)", "value": "95a8aa1c0c0b3fc775ae45cc34f5350309c77a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628565638, "uuid": "4b1e2394-5204-417b-ab93-75b5e335835b", "comment": "Malware payload (NetWire)", "value": "7dd512237f7a78e63a5555761ef8e67b528ef00314cd377fee7a8d24bab13d8c05d40f71519880bd872166cbe4d35f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628565638, "uuid": "815b0a55-6bc6-47b2-8969-24708e849c44", "value": "T176C4AD3B16548623F47CD2BD6A58121BF278DFD3F4DDE9C6EC872180C672A4329851AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628565638, "uuid": "a7c05516-99de-466c-bfb9-0be55e23044c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628565638, "uuid": "b80cfbf6-61bd-49d9-8257-a2f339d210f6", "value": "12288:LT/QcVoZt9IFiohrl+N8+kR1AK205UbtCmJi2q2kpLa:Lc+hBr1AKB5UpJq26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628565638, "uuid": "874b353a-f89c-4fa8-8a05-8a319206f689", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628565638, "uuid": "18c5b6fc-901a-40d3-98e2-ce7e008e9c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628565638, "uuid": "84f4c612-1490-4573-bedd-20b8c07fbf74", "value": "99693F2F6C85421734381A0957F5E382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ddce84-f9a7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628578457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578457, "uuid": "8ffe6a0a-6ad1-4e9c-94d8-3391be183817", "comment": "Malware payload (SnakeKeylogger)", "value": "f1a68e045db072db6cc5ccfca53b5b11", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578457, "uuid": "6c004165-dfda-48c4-abaf-676c025526ef", "comment": "Malware payload (SnakeKeylogger)", "value": "be95c3b8c727bf769a9ef892c42ff2a3ed9fe764d3297f3214e715e243c69995", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578457, "uuid": "bc6be9f8-89dd-43b6-966f-68233f60e0b6", "comment": "Malware payload (SnakeKeylogger)", "value": "acdcecea1cdd7d215fd97b8323715ee0d5365897", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578457, "uuid": "5bf832fd-e9df-460a-9b35-7a0ee56f4113", "comment": "Malware payload (SnakeKeylogger)", "value": "31438d7fbe3f3d58ea494029ff33c4cf66a333eb8405a0a815343026f61fe9c43c29b14d3180707920083e5cd1185cd2", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578457, "uuid": "7ae37fde-a578-444a-9e18-50070252fe24", "value": "T199D423EAE5D16F3E5325A88D4735A7D5C47B52CAD206E30B74C934834802E3BF7E62A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578457, "uuid": "47cc7081-2212-4a87-89e8-1c44a37d9407", "value": "12288:yDTR+PauuhVbdDtuki8QlXQze5rQ+ucgOXOXQexnymW3hJ+lcet:ycPauu3httbQlgyS+ucgOXOfnyIlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578457, "uuid": "4d99590a-d958-4beb-b93f-9d1dc79780dc", "value": 621231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578457, "uuid": "254504a9-6b9e-4721-a605-64625dd890b5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578457, "uuid": "db3824ac-187a-48a7-826e-7fbe97540168", "value": "BANK INFORMATION.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e011a14-fa17-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628626249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626249, "uuid": "93ebc2e6-4cdf-47f6-ac67-ad55865075c1", "comment": "Malware payload (AgentTesla)", "value": "3bc86ac6b99cd20ae67a38f81396aca5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626249, "uuid": "5e4db9ed-1685-480b-909d-682639a5d315", "comment": "Malware payload (AgentTesla)", "value": "bebc3da436336c51dd91d24c9f57dc84743775f89f878c0eee75d442372b3749", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626249, "uuid": "9b963e35-076b-4798-a67f-08c6f51e033f", "comment": "Malware payload (AgentTesla)", "value": "8ca449b1fde37550983f4b9ff839748d7e227f12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628626249, "uuid": "d5ee1662-5d41-4419-9bdf-8c5b6c2105c5", "comment": "Malware payload (AgentTesla)", "value": "e4e647c975bbd72e5b37ccc02dccbda7221a17039d0fc721e3945d374dff32d95628e7eb8cb96610bb8418d5eea70ea9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626249, "uuid": "fcfc3adb-9d0a-4914-90db-f4a2344013df", "value": "T1EB05F14B27808397C4159B3B189953420675DEE5DBB1EAAE3C82393E1FF6342CE16B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626249, "uuid": "89668a94-4464-4a87-bd50-a9285292fa8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626249, "uuid": "8fd6319e-2c3d-4264-93f7-54f4650d9dee", "value": "12288:LIfKxn3qGaNHEyC9/oR9gy5FHK7znJ8oL6LuUe6pD24QGGnC+i8KQKcusXgPTlrf:LkKpPp9AR95yaoLEa9M+5XgrlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628626249, "uuid": "99538da1-efc4-48bd-9e0a-f4eca310b74b", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628626249, "uuid": "5e6b3c48-18a8-46fe-9328-9b5c0511c0d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628626249, "uuid": "7eca32b5-999a-464e-9201-fae707449e3c", "value": "invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d138b8-f9bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628586912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586912, "uuid": "51906e9f-8e8a-4203-ae0d-34bb34cd6903", "comment": "Malware payload (RedLineStealer)", "value": "757f0a9413bdf1e4b1c9b9abc66eb629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586912, "uuid": "205f7494-3687-47c7-9f0f-2a110b8461e9", "comment": "Malware payload (RedLineStealer)", "value": "bf96ed8aa602b7611ef90657e75b9612d2a49e57acdfaf4c3f8b40ef562651cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586912, "uuid": "2886bfae-d198-45fd-899e-d6752c1de330", "comment": "Malware payload (RedLineStealer)", "value": "248f4810bb3d4350b2bb09eced1c557e9fcc8740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586912, "uuid": "fdf56b64-0820-4e6e-9c76-e9eda202b032", "comment": "Malware payload (RedLineStealer)", "value": "11170cd4c3c904263fec0c5fb1fcff90e8f31a2ae6c7fdd8805e26a9eafdf231c550da065542e9e69fa536eb6f82e7a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586912, "uuid": "80de5ea1-82d6-4d2b-bea3-dd90ba35d13e", "value": "T1FF94BF30A790C035E5B712F845BAD3BCA82D7EA1673450CF96E41AEA57346E8EC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586912, "uuid": "d91e27ca-93b1-4b95-bdd7-9b79f08dcb9c", "value": "10d590d1f4ed2f9a6fb903cd9f148a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586912, "uuid": "79b7e6b8-94f1-41ce-9ebd-d0d44f8f8d7a", "value": "6144:Q7aSvtHjxBLSfDQLUj1iA+rfdSjGpsoZ2bcgy4rvEGs7437sFjrJKPiEOr11Hk7K:OvtD/PLUjcwjGmo6HvjsEAFjcRYNk8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586912, "uuid": "a685498f-1e4f-4453-838d-b808c508316f", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586912, "uuid": "9f0d6114-922e-43ae-a07f-fb163b13bcdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586912, "uuid": "e6b2526a-6be8-4a1d-aacf-af6767746fe1", "value": "757f0a9413bdf1e4b1c9b9abc66eb629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5311f42-f9c4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628590854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590854, "uuid": "f5ece767-1824-426a-920a-a19c8123f152", "comment": "Malware payload (AgentTesla)", "value": "9e778790fcd25146473f368ccfbd3558", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590854, "uuid": "64af61ea-d707-487a-a82b-97a19e4c3bec", "comment": "Malware payload (AgentTesla)", "value": "c0c7d0cc6d11b72ec7c8114b13e75221b2a0328866eab8d7182617678db9e143", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590854, "uuid": "a862188e-0416-464a-890d-3456a5ae9e04", "comment": "Malware payload (AgentTesla)", "value": "b6d709e95772e043c46b55afd1ad382e74abce35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628590854, "uuid": "06381788-a557-4e50-b46c-088045c4738a", "comment": "Malware payload (AgentTesla)", "value": "e7a114837a4f29fb78bb24afa6372349c3a24ad1d8a4d31d3d566a3ebc8dcaee8aa0e70c1e0ecdece61dadeea6809730", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590854, "uuid": "bc851d2f-8c1c-4217-964a-dd2a99857a0e", "value": "T14D751A0C6DDEB26BF65B11BC356C10E85066FC19C708ADB7AE0ABBF67062E95503B047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590854, "uuid": "3d7b7caa-8328-4804-9e91-21d0198d4b5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590854, "uuid": "ff23de0d-9670-47af-bb5c-b5743981f6ce", "value": "24576:3g802c6W5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJp:QNiecNKbtDG4+N1ZDJww+NQuiNB/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628590854, "uuid": "7323a428-4869-40bd-96cc-0c8c0369d1b4", "value": 1695744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628590854, "uuid": "7e4c2ccc-ae87-4c7f-a28a-210843f7d75b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628590854, "uuid": "ef3d089c-4da1-4100-94eb-5e13103458ba", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12db7083-f9f0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628609506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609506, "uuid": "00878ac5-d2c8-464d-a1bb-deacfb259918", "comment": "Malware payload", "value": "7c5e83a49bbe44113c444524cbe7124b", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609506, "uuid": "54fc8ec9-35dc-47c0-bb86-d04c5963b213", "comment": "Malware payload", "value": "c10a976dabb58f3ea812ed548287842a65903214ac1a92bf2d499f87787a50f8", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609506, "uuid": "8bab067e-8c6e-4c02-947f-86dc47df9884", "comment": "Malware payload", "value": "3c03d0bfc54f5fccf029f14f9a996c70d4f16014", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609506, "uuid": "cda206f4-cb57-4b34-9358-0f9b4ef17abd", "comment": "Malware payload", "value": "c25149f73774c4de086e2e8cf8d7602f804d89d53dcedf3e42a6a806c8aa138d8f050a82d96ce587607c7905abf460e8", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609506, "uuid": "9bc9dc10-85c7-46b5-acf3-88f1e7e04ccd", "value": "T1CE061226AF818865F1476970F5038243712947A70941F42F8A3678AB3DA7E605B3EDFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609506, "uuid": "9b71b10c-042e-43e5-824b-0c01af2e6b29", "value": "98304:8Cu1BeWBFCXIaVzW8lOqX/31qbm8fGH7b/5:4I7dV1qGbbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628609506, "uuid": "fefb3624-9375-4344-9ad9-10672c0ef2c4", "value": 4013915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628609506, "uuid": "845657f9-c5bd-4047-bdd3-03f611577ee3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609506, "uuid": "417b51bc-965e-4c3f-9962-7664c229ad5d", "value": "Chrome709341.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28476166-f9bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628586779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586779, "uuid": "3833459f-2bbd-48d3-bfe9-1280d4e30f10", "comment": "Malware payload (Formbook)", "value": "0805c568ebc462721f7eb11b15689d51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586779, "uuid": "01167448-cd8a-4377-b872-e80cfcbb0fe2", "comment": "Malware payload (Formbook)", "value": "c1ce2e8d13a1272f8f4db5ff64b9fa10660d7040f71ac3de3e09a775daade60e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586779, "uuid": "db48193a-3171-4405-b07d-8ac8b04bf40a", "comment": "Malware payload (Formbook)", "value": "ec3aeab30e49c7923783896142187e61927595ef", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586779, "uuid": "7f4b25ce-ae02-435c-bb5c-2f93b38de369", "comment": "Malware payload (Formbook)", "value": "68e4a421331c7aaac08f2e349a5956ed7490fda8c9f97f61607fde4c17e10d4d88b68214254dfb185dcb8853f5dc4f8b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586779, "uuid": "03490831-5e02-4eef-9b6c-aea19e96f3fa", "value": "T153242323BB2C89F078712C1532012ADD74065BE395E514B8973C958A9FBE89F288F7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586779, "uuid": "bb147b34-5893-475b-aa92-788af83a0d7d", "value": "6144:Fn+MK4LoaK4iIFOpOyrbrH0dltBhqz1SC1mGTlu0rO6304:Fn+RvaziIuOUH0dltBkhS5GAkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586779, "uuid": "485ddc5f-fde9-4061-b4d5-16c0a4e26978", "value": 214594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586779, "uuid": "3cb2715f-a94c-4e6d-bb54-7f06287ce84b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586779, "uuid": "b2cfe13b-39ee-46ca-8127-59d7de2152bf", "value": "Payment Slip.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fd2f1b-f9fd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628615060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615060, "uuid": "d8bde820-10ed-4187-bd6d-bd8b2cc47652", "comment": "Malware payload (Mirai)", "value": "11b53b23155d6db9f7afb599bc62c0d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615060, "uuid": "978a589e-cc96-421c-bada-ecfcc647126c", "comment": "Malware payload (Mirai)", "value": "c1ec589884d05d027cd51f3236e1a67edb369a332c0d9e2346a0e12ca32297f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615060, "uuid": "cb846c43-cba5-4cdc-b384-97b5b4ba499b", "comment": "Malware payload (Mirai)", "value": "8c37aca2f4504bb45bc6fb616bd31b7d2a6c8e31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628615060, "uuid": "d34ea33d-3213-4eb4-b452-56875b5edf69", "comment": "Malware payload (Mirai)", "value": "3e0268d2db4360faff94b58c5b901abf8a12db8bc120667edf722e0a7b33ae5b7615d352891e13752bd651fb0d5041e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615060, "uuid": "2640145b-bc3e-4745-a4f0-07b60f5bc6c0", "value": "T13003F264B76A6485C742C0FF2366FC136A3390CB8A59DBD7506CA4B303DD91B4DAACA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615060, "uuid": "7b597394-45ae-4200-af2c-db288ba0721a", "value": "768:if6r4+uvlrdV+3BjUvERoxKg5+m2pmrAFPGGG2vHle3wAo6d:ii4vlREhUnog5+C0hGGBgo6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628615060, "uuid": "fa05c8b8-1d59-4d56-974d-1fe085565ba6", "value": 40520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628615060, "uuid": "0a271031-d07d-4ea4-8e6e-2be73a674df7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628615060, "uuid": "18405a1e-eee3-49be-b32e-a2722d623684", "value": "11b53b23155d6db9f7afb599bc62c0d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74722d8d-f9c7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628592061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592061, "uuid": "6ee8a1be-b99d-436a-b0d6-2e7b77db18f5", "comment": "Malware payload (AgentTesla)", "value": "70e5168326095b1ad402e41222837f79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592061, "uuid": "75dfd720-4608-41ad-8620-a8d9feb168e1", "comment": "Malware payload (AgentTesla)", "value": "c26cb3982da7d8c5cb4b45127e8d532cc5588d20a2ea6c52109342c4234e9924", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592061, "uuid": "ee24366e-b9a6-402d-88ee-0ffd6513461d", "comment": "Malware payload (AgentTesla)", "value": "7e0071ef586845370b636c9f8115644aeee97f4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592061, "uuid": "daf53e1b-2f1c-49a2-8b08-a91dbbca989d", "comment": "Malware payload (AgentTesla)", "value": "d56004d494858f8b8443ceb09c7bd50dbbd01f38777882c7bcf9c12922ff7949ee2bf314a98d8a5322fa75947b5ca3b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592061, "uuid": "dd7adb5c-74e3-4be5-b530-d38b01ffdb18", "value": "T1D7A4AD3F0554822BF97CD2BC6958165FF228DFD2F0DDE986E8873486C971A0325C46AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592061, "uuid": "b24cc9ae-1ddd-4682-b419-b41d4d86437c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592061, "uuid": "40402942-1b8c-4ad1-aaf7-90b99a180e7b", "value": "12288:cfSCfuiJ6B0nP3oODmcle7ktH5T3sgRGv:c6CVw0voODfmkh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628592061, "uuid": "6e4c72c2-6c9f-48d9-b91b-7d0351d150f2", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628592061, "uuid": "5b42a3b3-6696-433d-bd32-8702481970f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592061, "uuid": "3b134063-4885-46e4-ad5a-3523dd2165dd", "value": "SecuriteInfo.com.AgentTesla-FDBQ70E516832609.5728.7445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ec3a2d-fa12-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628624458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624458, "uuid": "8ae46a4e-c717-4aba-bc91-6b86f391ddc2", "comment": "Malware payload", "value": "4ff37a0aec6b88a8272404aef7aca057", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624458, "uuid": "e38e5d2c-9864-4767-9b3f-6f7ecee35ba1", "comment": "Malware payload", "value": "c33caa28d102a71888dd03ab8efc724db2db23c78909a5e9a55c616a353f5b10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624458, "uuid": "fd16bdda-d239-4430-8998-9011ea58a82e", "comment": "Malware payload", "value": "9766287fd2f097338686ffb67c0a8b214307207d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628624458, "uuid": "a9ef0bef-6dce-464a-9ab4-b77a7b71d96a", "comment": "Malware payload", "value": "d52320c797b4e0aa6de690f8392d7803cde4e96af1a1d53598be9f43d7336298ae4714d1ccc512d203d9f3e19e8d2a29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628624458, "uuid": "541664ae-791c-42fc-a03f-541d783d04b7", "value": "T11CC28321F161E996C68C3A328CDADAEB26787C51DF578A17F39877BF3C71640CA11604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628624458, "uuid": "34b7cc52-f219-4ed7-873d-13ec0dcb7010", "value": "384:B3F309xYuxh2Nbkhcd6Q84eGTA4WWO8Ipf6ocg1LSkFThrSrc:9RPWQNb+GNvY7Jc6LjFThrSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628624458, "uuid": "e5ba9186-d62e-4386-940e-7ab8b9f69c2d", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628624458, "uuid": "ae5a396b-de81-4607-b740-9913643676e6", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628624458, "uuid": "2aaf9b05-ef25-4f8c-9579-f02c66ea8a06", "value": "SecuriteInfo.com.VBA.Amphitryon.3493.19586.3916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1928efe0-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628576446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576446, "uuid": "a7747170-0994-46ae-b6a1-517e2ef65e44", "comment": "Malware payload (AgentTesla)", "value": "50f48389756e93bd3674004caf2f7aef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576446, "uuid": "b1fcd514-6d8f-4dc5-afde-17409f62f7c8", "comment": "Malware payload (AgentTesla)", "value": "c3d91e6107b188a28ccae2c7a483f4bcaeec323ee76b181e8db6cadce424c442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576446, "uuid": "6d69f1c5-6e09-43e3-8ab5-42f3a5e35d9f", "comment": "Malware payload (AgentTesla)", "value": "ebb485de5479bae5a10874e9ef59d0761bd9a408", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576446, "uuid": "83109078-c1e4-4bd4-9c49-b9a6404d3ce3", "comment": "Malware payload (AgentTesla)", "value": "098fea956bf901b1bf60104a51cdfea2482a53920d05dc9bab61ef7cee175aa7452baac40c8417d4c9ec30835094fb70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576446, "uuid": "cd6c99da-e241-467c-af6a-71fafd297e79", "value": "T1CD5523BF5C49DB90F32B1A71A172B373D124DDC49524CADB73043A209B3EF258581AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576446, "uuid": "56ed7112-6796-4f9a-8e3e-52c2d48ecce1", "value": "24576:+AkN2HZD67wigq2XkWR2HYbZFROppMuQKp+cyaAl+mke56ig:+Dss7wiUXkWRjMXXQGxe0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576446, "uuid": "5533b3a3-b171-4de7-84d0-8e5280303030", "value": 1377432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576446, "uuid": "cb479762-3d62-4394-892a-e7a94cd17b32", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576446, "uuid": "51c08601-0cfd-4875-b0b1-e4a224bbe722", "value": "IMG_20210610_000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603ec5c6-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628581289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581289, "uuid": "897b32b1-3b2e-46f9-9180-1a08249d0d65", "comment": "Malware payload (RedLineStealer)", "value": "652174b7fa6945f30bc078d39ba1d048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581289, "uuid": "ae794541-d788-4b1c-be83-a216bc962c5f", "comment": "Malware payload (RedLineStealer)", "value": "c3e0549cd76ceabab50401d72e23ab89b43c2e82e262aa1deaa9bf16a1aa5be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581289, "uuid": "895b86d9-8154-42fc-a173-56d495a73f33", "comment": "Malware payload (RedLineStealer)", "value": "f1ac626f2d149b0967956d4ba0300e55f344453b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581289, "uuid": "976b42b4-12db-4479-90be-61697a54bec9", "comment": "Malware payload (RedLineStealer)", "value": "5d7a891f99cdd808e072b479ec2dc168926513071a1941b8e283764d2c8935f76dd6dfee215d55a844b48d4cc7ef77d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581289, "uuid": "e8d1e8d9-6bdd-4a95-b2fc-5be3f249aebb", "value": "T19164D0313A90FC36E49B4531345EC7A4FBB9B820A754424727993F6E6EB33C1237925A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581289, "uuid": "6eeb8daf-ab81-48d6-8479-fbe51f6b215a", "value": "97856e36aca27ff13ae687d21f9f6f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581289, "uuid": "90d1c220-c883-4e0c-a9d3-4f8b824bab62", "value": "3072:x4fEG/iBfTt4lMktRt0Q7EkoQQLs0Whmo9K/+TiC35isMs8bSwKARqso9CX5Lh7Z:uixGby6eLPWkoK4vfR6qWN+WWCIwJIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581289, "uuid": "dd94ccfa-d56a-4d66-bf2a-1a68955d4d28", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581289, "uuid": "79f631e0-8565-44e8-b5a6-06cd6c8afc30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581289, "uuid": "d7cd99ae-7c22-4aba-9342-874922fde5c9", "value": "652174b7fa6945f30bc078d39ba1d048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec15e39b-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628586678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586678, "uuid": "fabd83ba-65da-4f39-9911-a69c93f7391d", "comment": "Malware payload (Gozi)", "value": "826e27ebe4950a57b944757673b9a93a", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586678, "uuid": "9b84f28d-858f-4c54-91b7-37b773745c56", "comment": "Malware payload (Gozi)", "value": "c45c6faa94764a703ef64098046ffbb24eebd81bc360f31f441b884a8cddae5f", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586678, "uuid": "9f304a79-dd83-4b65-920d-c30062f0c00e", "comment": "Malware payload (Gozi)", "value": "2fb95c18197d28fa2f06256320db4b277e126671", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586678, "uuid": "634df04a-a7e9-4d00-8842-89248e3828c9", "comment": "Malware payload (Gozi)", "value": "d3a4b4ede96a8c083ec9ab091687b32cd12e7d6094b41d6267c67300705cef17e42ae718b19d5a1ea4b419e6277b337a", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586678, "uuid": "f3c999ff-df08-4c67-abe3-af0b10dd52ba", "value": "T1E9A47A143645ED32D1E326320B55E5A5635E30752B3440CF3AEC7EAE2FA55E32A3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586678, "uuid": "1896be1b-9854-40b5-a908-dee219eb823a", "value": "c8043e6c49fd266fe13abb78b85e530c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586678, "uuid": "0112b5ce-7878-4835-8f6a-fd54f2d8cf6d", "value": "6144:5V6cQ5JWuSGbFMmNMiYrA9JnAURrQS4e25BbUV7TXSwtiYRhicrBn25ywXCu16AB:5VGJHd5MKbfrme25BAvsYOJywyu8wXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586678, "uuid": "6e1803dd-0cb4-4b9c-b682-2f8a463a14dd", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586678, "uuid": "f522f7cf-fc9e-4290-afe1-5bbdefedda8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586678, "uuid": "cf451ca9-3e09-4990-b29e-f88bcca19329", "value": "611242387c2b3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a308f4-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628600730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600730, "uuid": "0bdcd7d1-69e0-44f4-941a-0f32da3c7ae6", "comment": "Malware payload (SnakeKeylogger)", "value": "f81dc3b82e36c1a5acc3f9f02b44c39c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600730, "uuid": "90527407-6312-4e89-b8b0-cb9f13aeb0db", "comment": "Malware payload (SnakeKeylogger)", "value": "c4fb72854cb3f3adc48c5a8c0d9f5619ec0f050c6ba618639df28d3372de2aa9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600730, "uuid": "c24ef92b-f9e8-4a2a-ac2d-4fa39bbb3e06", "comment": "Malware payload (SnakeKeylogger)", "value": "c392bbcd34b35534e341edd0cf04eec9fc5c43ad", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600730, "uuid": "fa5267b3-157b-412a-9ff2-832c1ae91633", "comment": "Malware payload (SnakeKeylogger)", "value": "b646c6e626a6f11042bbd63f1679da24d9080e43017b8fc8b58f17efdd6e74ab6d430692adc3a5e4e0d6845a99a2324a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600730, "uuid": "b326987a-642e-4e2a-94f0-37fbefc86230", "value": "T1E72392ACC86B06C4CF88ABB96B2B2F54215C377CF74599323578577867E2D39911283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600730, "uuid": "ae98c915-eb1f-4e9b-847e-e198ab1ba0dd", "value": "384:c9Xvbl7uJFFGysSDL/XuqcyBAqYSv9nZpScZfDKDj:c1B7GMCryyHVnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600730, "uuid": "ca481c11-e0a4-447f-a314-4645175d2f55", "value": 47114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600730, "uuid": "27f4aa1f-99b1-4e1e-b85f-bf1515caa422", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600730, "uuid": "966c65a1-a883-4778-bbeb-df6c390c5dc3", "value": "RFQ-0810021-061.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f94ca6a-f9e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628605260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605260, "uuid": "ec216f53-a2fb-47f0-bb39-7a440bbc8eb5", "comment": "Malware payload", "value": "24085e9f2ec50a927c17ec9cf9616343", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605260, "uuid": "d283023c-d508-45c2-8168-10f586a6ba08", "comment": "Malware payload", "value": "c57b084cb370c65fd6fd14870f5fdc43385ccc16e884a7838281fd13daa0ea84", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605260, "uuid": "c5b95b1a-d337-455a-8bce-596b97474a30", "comment": "Malware payload", "value": "bd979f170505c240ff6eb9de48ad02490b660ec3", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605260, "uuid": "7ce6a07a-f402-4549-a1ab-35e6a9f79bed", "comment": "Malware payload", "value": "572e2e4b6ef3d718f23c540af860c4da41d2dd6dd71062637b486781373371bc05ff259db99098a63b4e5e06467d7ef9", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605260, "uuid": "be095ab0-0582-4f2c-8ca0-815aa24f7b4e", "value": "T10EC1B663A2C38A1A95794F693F88709C236FC855D74BC16C3B3E67E42EA601C52D49E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605260, "uuid": "385541db-adb8-4ca2-a629-9b10b199160b", "value": "96:xIChoINMpMjyGMpSpzar1qQax3lh4XCyW8/1pKpvpSYDONYcfSPTeVexVvp:xIWomySar1qp3PyVxYDONY+MTeVexVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605260, "uuid": "54c64124-7b6d-48b5-872b-a92d32a046de", "value": 6133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605260, "uuid": "116eba87-1840-46b4-8a82-5a0060baac16", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605260, "uuid": "62e0db3c-0d41-4c68-b8f7-9db2f735635b", "value": "04-32250.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5eae8a-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628608798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608798, "uuid": "26dee87f-27ec-4885-99b7-d035eb7402ca", "comment": "Malware payload", "value": "0a125b6c2639a01c8cd3b960c55e2369", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608798, "uuid": "127b1752-4f88-48e5-9d01-6009d1f4a007", "comment": "Malware payload", "value": "c5d5bd4d5b66de5559e4ebb98251b74b49baa08a50cfc8f69b2c9005fcc861a4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608798, "uuid": "62719a36-8143-447d-8357-cc94a7d3202c", "comment": "Malware payload", "value": "190232aa432033b7be99cc8fe154fe5341f67578", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608798, "uuid": "1e56b3ab-e6b6-4bc7-98a0-a3950d12c7c9", "comment": "Malware payload", "value": "7c5dcc7ed75001bc6769f63334cdecd1a9da4663b1c12eded869480f19bdeb1dd9d61b534ff7d1ed29ec49e573a81a92", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608798, "uuid": "9b83c857-7d38-4689-af60-d1ba512312b0", "value": "T150B59D1239C6C532E97E45306A69DB3B14FE7EE00BB188DB63D45A2E0E745C24276F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608798, "uuid": "bc0bfb73-dac1-4465-96db-1ac0ea565744", "value": "49152:/mzrz5io+HGGWxyzYlrXVVdWgAhmLQr+uclpUO3mDOSP9HnoA/s5tFsy3I1XF2Et:rGGWDlDAhmLpUUEXF2DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608798, "uuid": "5284296c-7650-4a53-b5e1-50e5646128c9", "value": 2307584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608798, "uuid": "710d5fc7-53be-4f6c-a7f7-403566ab2e6f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608798, "uuid": "7c7ed356-f47a-46d3-8987-1edf8f8c60af", "value": "ContratoAprovado+002336.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb57e7f-f9fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614541, "uuid": "ea0f48a3-6b8e-4079-8565-44466dd976a0", "comment": "Malware payload (Mirai)", "value": "f493d86ed592937a36f6b90b4f2540d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614541, "uuid": "f3c05882-5370-4472-85c6-5a725da6be23", "comment": "Malware payload (Mirai)", "value": "c61b7da3558482b5d70d567154d78c2260219ffa71a7fd916780bbce704f8a11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614541, "uuid": "1de5575d-b9c4-4d7f-a0ec-b32fe7001419", "comment": "Malware payload (Mirai)", "value": "dc4cc947072cf643568b42b4f1e199ae522b1cc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614541, "uuid": "1c8be559-b2dd-446f-b07c-549c7565c386", "comment": "Malware payload (Mirai)", "value": "a48d260a65420a2a68dd3ab5d50c391ddc5192e27eefb87694e69046c033ff060024da279f99837ae7e748004bacda31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614541, "uuid": "cff89664-468b-431b-aa98-37f79e21e5ed", "value": "T11DE2F13ED5911056C305B53E36A79EED77BAEB20D0C4595B4504AB0C3A4A21E3B434EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614541, "uuid": "069d0ef7-1314-44b3-a0fa-8744d5f3216f", "value": "768:u5M3eESubiC3EVLERVF7pKgSXtTREOEni0oJnjz:u5M3eESu13NVF7pKNdETM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614541, "uuid": "1601dece-78a5-4ab6-9364-af3bb035aba5", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614541, "uuid": "c68f262e-aef4-4b26-9b25-dffd3264ca59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614541, "uuid": "0801c0a3-e702-41cd-bc97-7811edfd5dd3", "value": "f493d86ed592937a36f6b90b4f2540d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bab6445-f990-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1628568343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628568343, "uuid": "72d4f222-5ec3-4744-b9d7-fffcdd2be5d9", "comment": "Malware payload (Adware.FileTour)", "value": "52e0049d89fc6b42320b9e0f37d113a3", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628568343, "uuid": "8611d700-eee3-4e53-a888-a1f9a78a07e5", "comment": "Malware payload (Adware.FileTour)", "value": "c64807b99c0f69113c15fbdbb6c52880c5c1df614eca08280ad294485bcf36d7", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628568343, "uuid": "ede3180e-1d93-4d4c-8ebd-efa32fbaa9c1", "comment": "Malware payload (Adware.FileTour)", "value": "21a89ea297f6239ff56accaf163baf81b185ec94", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628568343, "uuid": "2d3c3a52-7713-4230-95c7-26f9133c81d5", "comment": "Malware payload (Adware.FileTour)", "value": "53c02db9634b0cae8b9af4cf386cfa800f753ddccbf07982e2013c90216e8ac51d541d9c6398cf4fba8b920ca56a4e89", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628568343, "uuid": "90c461bb-afc8-4e14-8024-bcba3313bd8a", "value": "T1ABF53352B3D780F8EA121436ED957F735179831C176448F3B3649E1C1F2AE2A921E92F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628568343, "uuid": "8892fa05-229e-42b0-b51d-632816d9702f", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628568343, "uuid": "6cb03a3b-e57d-432f-bd0f-ec5bfb274f09", "value": "49152:xcBqjiicsXJKTEvOtsbUv2qVjAbcZ49Vjk9/Ssz4sbJOLEwJ84vLRaBtIl9mTHqs:xX+iXGEmOW2YjAzhm8gCvLUBsKHqb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628568343, "uuid": "a7a7e205-744f-409a-beef-c45bb7dcd8df", "value": 3350009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628568343, "uuid": "b4dc4e67-004f-4387-9382-4c0a7c645589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628568343, "uuid": "dcddc57e-96a2-414f-b82e-d94bb9ec62d0", "value": "C64807B99C0F69113C15FBDBB6C52880C5C1DF614ECA0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dc1b8b-f9c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628591288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591288, "uuid": "7ffb0c4a-0da8-40e8-805c-a54595711849", "comment": "Malware payload (NanoCore)", "value": "8e5a20788e97f7c76224b87e82d5aca6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591288, "uuid": "d349da96-2321-43e8-abdc-f007e40b3dc7", "comment": "Malware payload (NanoCore)", "value": "c837280f88c94c57bc0378d783e465f47043ff97db1cacbcac28819176f5e9fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591288, "uuid": "a4df9867-4eb5-439d-accd-af346fd184c7", "comment": "Malware payload (NanoCore)", "value": "f2d8724bf3ce016c3fb12a5d08af26d4a0919c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628591288, "uuid": "a865f51a-5c3f-4319-8da8-78b010501733", "comment": "Malware payload (NanoCore)", "value": "0443c2580f561c8eae5a93df5d982014e85bd26cc9be180e296b4609e86135dbe2c74f4555230609a713a722fe6e921a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591288, "uuid": "eafcce3e-7838-4564-930a-ac93f30db428", "value": "T10E750A0C6DDEB26BF65B11BC35AC10D85066FC19C708ADB7AE0ABBF67062E95503B047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591288, "uuid": "c766cc14-d25c-4e1c-bafe-dbe928479890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591288, "uuid": "ea59a889-ff57-42ba-a97a-b3a9a3be93a6", "value": "24576:bc1LTjW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+C:eaiecwju5uwYNQuiNB/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628591288, "uuid": "c0d2d24b-e30c-43cd-8802-c7c0b45a49a7", "value": 1667584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628591288, "uuid": "048d0ed1-52d2-4dfd-a12e-4b834499e74a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628591288, "uuid": "349456db-f4b2-4571-a5f7-42abb3727291", "value": "ORDER TSA-A090621B MV Hyundai Viet LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14d650c-fa07-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619651, "uuid": "d7d37e37-e25d-4daa-bd02-6ceebf578856", "comment": "Malware payload", "value": "d017385b2901daceb0d9f7d76937ca17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619651, "uuid": "5ea9cbfe-b54b-4bda-be61-c2a96eaa9644", "comment": "Malware payload", "value": "c84de27134dc976dd6b28eb01c59cef8907dcf7d778ce1385ba152fe325216c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619651, "uuid": "43e4a9e9-cb28-4ff1-a5be-8f7083a34ea2", "comment": "Malware payload", "value": "a0a29d81d55d2d180d2c893735457dcfdb7845db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619651, "uuid": "3d8ec182-b260-4463-beb3-559b3da7e0c0", "comment": "Malware payload", "value": "8648960d5f62f6976bcca1a818c6619a3bb830d2fd234ef157749c508d4699740a60f9820f10c8828433589e58de19a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619651, "uuid": "43bf220d-1fc8-47a0-b0bd-d1936f28b6c6", "value": "T1F5260281A3D83845F5F38E34A9B28ACE6A3FBD5C5A30C15E5121B11C8E77BC1DA747A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619651, "uuid": "bee40bbc-071d-41ba-86a9-186a48a87260", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619651, "uuid": "10cd33a5-ed0e-4150-80af-964cd8ce214d", "value": "98304:FiQV259PaNe4/J8bcmUhc9tclqTj97fCZ6UmcLYMX9B:ZQCc1bshcXcc3VCBmcLYMX9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619651, "uuid": "01090ffa-984d-4da3-af3a-5fb01b5133c3", "value": 4506304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619651, "uuid": "a6576aa8-3094-4886-93ab-4674bc40a963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619651, "uuid": "210bf2e2-c132-40a7-862e-5314d22ead75", "value": "d017385b2901daceb0d9f7d76937ca17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b290be6b-fa22-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628631249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628631249, "uuid": "33ff0256-e01b-4869-b026-c282c9fe7def", "comment": "Malware payload", "value": "3ad14947002e57887b82643d729c21ae", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628631249, "uuid": "ed5288c5-ef8f-4e7e-b183-7fb2e9492b49", "comment": "Malware payload", "value": "c8768d4a4979d4b5ab4e841fc29523d8d80c52d6e89f345a0a44e75973f3d3af", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628631249, "uuid": "77faa78a-b61a-4d9b-a6ae-f6c6ef9ecb79", "comment": "Malware payload", "value": "8da8e1db4367bfffb8dff6828619dc3c2a444ffe", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628631249, "uuid": "91cd86f4-01e1-42c7-a8bb-355f976a25d2", "comment": "Malware payload", "value": "b1ddbfdc931d1f83410d099a276490dd53a7491fb3f9a9ee769287a4e84b826971befb810ecc651410a023d91acf575b", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628631249, "uuid": "1490fa14-88f5-4219-a4b7-53984328735a", "value": "T1C6D39EEC095D6E7AF040BFBED402B556A39F1F7A8DB8A64E9FBA9AC7C4404D0500846D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628631249, "uuid": "9287ada3-598b-4f47-8356-fbadb804da86", "value": "3072:lltCwaOaVLODCK4q2haCABpiA5G0owzkdx/n:lNaVqOKrPBkcG0AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628631249, "uuid": "2408fefc-8db6-4088-a079-fda16fc59acf", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628631249, "uuid": "db4cb3cb-e72c-446e-8565-8d9c745ff486", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628631249, "uuid": "42a85225-fc0e-4ff9-8dad-b48f87954438", "value": "2021-07-02_16-42_a47cf00aedf769d60d58bfe00c0b5421_001A0000.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d6684c-f9c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628592551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592551, "uuid": "2fc69928-a61e-46e3-ad6b-35930b7c1cef", "comment": "Malware payload", "value": "433a3e7b111b3eedd706aea1895ca330", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592551, "uuid": "3cec6ce8-2560-4414-94f1-434b40e005a5", "comment": "Malware payload", "value": "c92f13a0f1702262ada322977666fdf233917d30e2b469662bb0d1ccf105ddc6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592551, "uuid": "2cf50f78-b7c2-46a0-ae09-9894623acc01", "comment": "Malware payload", "value": "6043b3c359eb719192ba5fc39d10979af383152a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592551, "uuid": "788ae26d-34fa-41c4-b789-7f30d7568d2a", "comment": "Malware payload", "value": "3143862334d7527157c1186491ab42dc106955af87adf966b0a0e8a7f203ce33b49568100d38323cfc5824b97c7804a0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592551, "uuid": "1bf77154-0244-4a21-abb3-d9ad9e0b4178", "value": "T116B11D52C527A6ABEEF77D4788B0F7A0586F349F0D0704607EB49B8867C61E5CD8E1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592551, "uuid": "101f2c92-15e3-4191-924e-4ffdbcc13028", "value": "48:VGG9dbJQ0J9pURh+UjFzlJqvGyJljFq/atVpJH1n5/jaj+Ef+aJgsbw65EKEPE3M:USBDhncUjTZkmh3BPmkl6Tr6oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628592551, "uuid": "6ddd8daa-b123-4946-b08d-68b7ae3a6650", "value": 5200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628592551, "uuid": "c20df486-21d6-43b7-b6c3-b7048c05e127", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592551, "uuid": "d340be04-a34c-4034-ad6f-f53b3cdc1405", "value": "fattura.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85da9d41-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628577917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577917, "uuid": "bfacd37a-7883-43b6-89f6-262a8802623e", "comment": "Malware payload (Formbook)", "value": "b8a6bff0de26505a8671135a34c21ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577917, "uuid": "9575e09c-1c39-4a2c-a8df-c9ff3ef4bd98", "comment": "Malware payload (Formbook)", "value": "ca928ee1114c01bf51f11b5200d0da9a823cd35cc4e616ddd3f44ddd3f3fcb56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577917, "uuid": "097ebec5-3547-4ccd-9b8d-07dc066d7be7", "comment": "Malware payload (Formbook)", "value": "3da946ce135ebc855d27681a9baffb8204013ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577917, "uuid": "aab6ca20-62be-4189-bb55-2723eefb4f29", "comment": "Malware payload (Formbook)", "value": "37cb80c34061e6b0cb8535fa49b005caa1ea671737937357890fb9edfd884233a944d229ef8b00e40fc6ae4f8935e1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577917, "uuid": "b8f35cf1-d0ca-4afe-b6ca-a9f7bb881159", "value": "T1BDF4F1322B986F12F47E97B98060108347FAF596EB22D69D7DA511DA5D26F80C373B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577917, "uuid": "5dda5936-ed5a-48e4-8650-0d4ccf1120a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577917, "uuid": "e38b0f17-8d5a-496b-a590-30500966c71f", "value": "12288:GtTk4E9YztD96v+vANmnhWvGY6sAL3+GHUKlbCOA0HK7znhyDBljJhqPTqCkUCM5:yYMhWjAryOWlyDJhqPTqXUg2JciMvo+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577917, "uuid": "d9a3dc3c-2e4e-452a-8475-5fe3dd62df70", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577917, "uuid": "c9ed45ac-857e-47f3-b439-dd1b06bfb2e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577917, "uuid": "b6134c3b-6d44-4921-8ea1-d413e1a02d3f", "value": "neue Ordnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea060027-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628603854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603854, "uuid": "d459874a-4768-45db-8c0e-5f9674b80268", "comment": "Malware payload", "value": "80c841dc59541171a95c208b6c9b06bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603854, "uuid": "9c08b359-97d7-4c44-946b-4f5245f9a601", "comment": "Malware payload", "value": "cb8679b5226b3f846932418f11d38b39bf6b315282f12a2a800ec913830e4ec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603854, "uuid": "1fcf57ed-5388-4469-a58e-eafeab3d793a", "comment": "Malware payload", "value": "84c92d0a76db450323c009253ece73ff447c6db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603854, "uuid": "5cfc6c66-54e9-4220-bf81-96a8845ffcd4", "comment": "Malware payload", "value": "08e2d7b95233450a71d904b2b0e7b88d26b08134bf1ed0b53d53a37e4cdfaaa6a268b4a15c7d3112c751d629f99e119e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603854, "uuid": "e90079df-e3a5-4b95-99f6-ad716b8b8a8a", "value": "T18AF3D2E7B43CA05DC0140B79E011FE477DA69EE4C5C1F635A141FBE6AA3A298CDE112E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603854, "uuid": "c40deedc-3423-422a-b153-f0d8fea70342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603854, "uuid": "078e71f3-0886-4251-be05-970b287d878d", "value": "3072:um3C4O59jv/hhUcwqbPznXn7Ajl29O8rFYeG:L45wIrXQlCOEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603854, "uuid": "42b63d9a-1204-485a-a852-f1c9ad4d545c", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603854, "uuid": "3e22b8e1-5014-4d7f-80d4-8adf7d020761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603854, "uuid": "c4d0149f-a158-4ebb-915e-9476846a1da3", "value": "80c841dc59541171a95c208b6c9b06bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be78d01f-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628584024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584024, "uuid": "2157a17b-73cd-4846-9571-a543421537b2", "comment": "Malware payload (Mirai)", "value": "2c06cd69cdab236ee9e3770a4f0e661d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584024, "uuid": "8eac801b-05d5-406b-9068-f3124bd685bc", "comment": "Malware payload (Mirai)", "value": "cbabc3e0740b36298852623dd15b91b92be81301784727ad562dead69e320ea3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584024, "uuid": "00eb3f10-dc96-4bbd-8abe-f173061c0230", "comment": "Malware payload (Mirai)", "value": "415e704dc52d376023fb81863b4d6ffe60554106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584024, "uuid": "e5639e7f-1a05-467d-b66e-1da20d3060ab", "comment": "Malware payload (Mirai)", "value": "aec45f6ca3895991d4aaa6fde7949717ce1ff13dbf82719d12ef969d445411b6bf3569a835cc9dd083ca0c9b09d0587f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584024, "uuid": "bdec6503-24f9-4906-a948-1e44b285096a", "value": "T154734BC4A5D3DCF5DD110B7530B7EF329A37E43A211AEAC7D3A8A973A942902D00729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584024, "uuid": "6ed9e50b-ca08-49c8-a720-76341fc292db", "value": "1536:kDBekNVZZfFOVJgi2NL7hh3jdpV+n7ZnOBXaKlqW4fDGYJjn:kDskNxfFO/2NL7hh3jd4IBPMb7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628584024, "uuid": "b82348b8-1160-488f-bcac-4c2cfe3f73bd", "value": 74544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628584024, "uuid": "28dcf6cc-cb55-44ce-ba67-bb5f614e08cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584024, "uuid": "89530c7e-8d11-43f8-9c53-161137b500e1", "value": "2c06cd69cdab236ee9e3770a4f0e661d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f7be97-f9c2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pitou)", "timestamp": 1628589830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589830, "uuid": "2446c358-6ef8-47d7-af11-762f2cd81e2e", "comment": "Malware payload (Pitou)", "value": "5baaf7e2ee2fdfac2a4871b2a7e240e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589830, "uuid": "cd1f5bb5-e520-43bd-9a6b-76e90f3a5534", "comment": "Malware payload (Pitou)", "value": "ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589830, "uuid": "3e5c5bfe-9920-43ee-8ff0-a8e2298341b7", "comment": "Malware payload (Pitou)", "value": "7ba0a397b0cd26180ea94bf3928fc5d4a1db22e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589830, "uuid": "611fa153-ba4d-4a7b-bb31-bb31dcf73584", "comment": "Malware payload (Pitou)", "value": "c1ef8cc4abe6b05296fdb84da37230e68dcc9137c7375d9115b5f2e28f133f2fb483653f0da4efa45ad27c1ead11db3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589830, "uuid": "b13063a9-56e9-492a-bf25-0e313b68c3d5", "value": "T141E4F130B7A0C035F5B721FC45A6A3BCAA2D3AA16B7041CF53D01AEE57246E4AD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589830, "uuid": "50a93a19-88c2-4f10-8b25-3b27fdb7713c", "value": "cc4caabe2c1a9c923331965c9764375d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589830, "uuid": "66b09f75-2ce9-43b1-b96e-15b5809a85af", "value": "12288:NMttNi9QvhSSYFwKzeNhfL3CwICzSqJRRMxNyJN+Uyy6pDcSluMeU:AjsQvfhfL3CwmqpJ49hJYMeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628589830, "uuid": "92d4dca9-aecd-4d95-81c3-3be8459a5506", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628589830, "uuid": "321a7a23-5290-43ca-8647-6d5af380c59a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589830, "uuid": "3f396b04-79a2-41a6-a882-bec89e5f6920", "value": "5baaf7e2ee2fdfac2a4871b2a7e240e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c916326-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (VegaLocker)", "timestamp": 1628577955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577955, "uuid": "a56ce5c5-6d07-498a-8606-a992d1d5af5a", "comment": "Malware payload (VegaLocker)", "value": "07f090249cbb74e99d45ef1b7736fb4d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577955, "uuid": "d993c8cb-8cda-44d4-9b7e-00939d40f2ee", "comment": "Malware payload (VegaLocker)", "value": "ce60311f972334032b25221385076f68474c28b6249e292b6925af9f16acb07e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577955, "uuid": "4f52de8e-4cea-45dc-9a0f-734c9be48d18", "comment": "Malware payload (VegaLocker)", "value": "17a7c3ccdf04a6cbc08b514e818ba26a150dbea9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577955, "uuid": "cbb27ae9-d8c7-4e82-870b-72ddceada770", "comment": "Malware payload (VegaLocker)", "value": "61dd9108e1187d4ca6d319ae24dea4662eb9c5585f9bab593f3bcce15abdfa662f788b80b28872336461396785706702", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577955, "uuid": "e677ef2e-31f8-4cff-b190-fc788a6da5f5", "value": "T1CF15C050EA0411661EC353AB9C5212D2BD3CD11193402269E99E93AC7B479ECD3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577955, "uuid": "df1a01ed-8d1c-434f-b331-aa21f3a1fd41", "value": "12288:yiymh/CjNSlCLQr3oXOHjY9mPbPSf297BazMGqjAKq1uiI197WzqBPs:RyeCxSlZCODdPzS+nazM7AKqQt9y+ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577955, "uuid": "450bc159-6178-4205-b58e-675a42237d12", "value": 946957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577955, "uuid": "c0980eb2-d57c-4db8-b0eb-c96071352c28", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577955, "uuid": "ef97b6bb-e4d5-4156-8ff9-910ea6870aa2", "value": "7114.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd002fb-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1628603247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603247, "uuid": "2fb27618-247c-4bb8-9953-6b359f98f55a", "comment": "Malware payload (CryptBot)", "value": "b0f26518a6a528d697ee4a335bdc73b5", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603247, "uuid": "b7bf0963-e721-4b7f-ad39-906a71bfc04f", "comment": "Malware payload (CryptBot)", "value": "ce7d94e2c15962b64b2ba26e656e8c11fee4b042c11021dc242ae1cf0b537b2d", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603247, "uuid": "142b50c4-6db2-4886-b366-4e1e7873a7e0", "comment": "Malware payload (CryptBot)", "value": "c30b0acf4aec48e55f7bdc7e671b35792b91dece", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603247, "uuid": "7357348a-7246-4cb6-ba49-a7313ba43115", "comment": "Malware payload (CryptBot)", "value": "fa34ff8bde3bf31450d6a1a4e107676ce3416d25dfef006bcde73afd28015eb2c641566d5335cc58faa1dd654c4c14f8", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603247, "uuid": "990b3750-0138-47a6-b039-07915bd2cd2d", "value": "T18AF4F1306AA0C034F5F612F8457A837CAA3D3EA15B7491CF52E526FA57386E4AC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603247, "uuid": "a4fc4e93-1b0e-48a3-abe9-98510ee3ac55", "value": "cc4caabe2c1a9c923331965c9764375d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603247, "uuid": "a4bf7b3c-bf9c-45f2-8ae6-e031566707c6", "value": "12288:LVte9iz4NoV304o1tLt48ixrbm/2hR3PMYG1uf3+2:fKm4NzWx2uh9kZ1+39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603247, "uuid": "422d85bd-274a-46d7-b514-7895be4f3458", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603247, "uuid": "1345e50e-8d0f-47ca-b177-c7d21ae72e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603247, "uuid": "fe7d2382-56bb-4304-87ee-963a686633a5", "value": "b0f26518a6a528d697ee4a335bdc73b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c000fd-f975-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628556760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556760, "uuid": "472991fa-75a0-4b96-a46f-6dab0b338066", "comment": "Malware payload (Gafgyt)", "value": "cafe29750fef9a335e41bcb58f613ff3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556760, "uuid": "317e1c0f-c4c8-4b8a-877d-6ee44bae97c8", "comment": "Malware payload (Gafgyt)", "value": "cf9c318d69c1bcba86828403abbdb8df6a192dd391e58cddc398c466fcb5e5df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556760, "uuid": "f69f4491-a4d0-4a92-b17a-5985985f376f", "comment": "Malware payload (Gafgyt)", "value": "4b5926989eedcd6509485de5b6ed7261a131cbeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628556760, "uuid": "4d2c50e7-db54-4e5b-9a50-d36988b6941e", "comment": "Malware payload (Gafgyt)", "value": "841b4287a63b0887053a18ec0cdc21b320a3d081106902d2d134aba485c74ec9fa3cc1e30a686bf6d85e7dde7049ca63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556760, "uuid": "87e6cb5c-3d07-4477-a0e1-05e25b1a0a80", "value": "T1CAE2E19DC27ABEB2C6201437AD600486B12F5CBAC66570F5621C0ACD6F73E8607FE5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556760, "uuid": "ae393ae5-09ff-4f87-89bb-c482437c3f34", "value": "768:AVbYc27tCSYy4H4ysqBTypstABzW0Dm28vgX9q3UELj:ksc28lYysiupxNWSkgmLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628556760, "uuid": "c1927675-cd34-4a76-9660-75a202426c85", "value": 31124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628556760, "uuid": "35c16be6-61a1-49b7-bfbb-2e1541378144", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628556760, "uuid": "52ac3bca-3e2f-4a3c-b550-93bb8b5a927e", "value": "SecuriteInfo.com.Linux.Gafgyt.BCV.22767.22529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ad0662-fa15-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628625528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625528, "uuid": "9365abec-4f94-459a-adb2-1995bd97cff5", "comment": "Malware payload (RemcosRAT)", "value": "c3564bf107406c43b36f5e9e4c5af650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625528, "uuid": "771ba55a-e00c-4b45-a486-24e8d8ff798e", "comment": "Malware payload (RemcosRAT)", "value": "cfb4e7b08343010cf746149e718c8737e4293390d02bc5bf30d46c5e73871651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625528, "uuid": "c5e61e47-5233-4eca-8924-8835a5ffcad5", "comment": "Malware payload (RemcosRAT)", "value": "c27ea516aed7e051fcd206ad3606bd8574cfecb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625528, "uuid": "3a83f0e8-df6a-4db4-812a-58412ee5792d", "comment": "Malware payload (RemcosRAT)", "value": "d2fc09ce49546446691f897a2f470a41667dfa2b8c584139d614a8a1836915088d67c8b60d1bc561a15f7fead7ee4d2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625528, "uuid": "390dfe5a-f710-48e1-9367-eb09e0c7cf72", "value": "T198A49D3A5458922BF53BC27891180346F3F199D2F0C9DA7BF8D3658A883236566C937F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625528, "uuid": "0780ab0c-cd64-4350-a898-02b75221feea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625528, "uuid": "a44c0160-e0ca-4243-a66d-c86f6672ad8f", "value": "6144:+rFicDmVT0o7MqCH4z7492xGyxLoYRzFH8XKKEqQZWIY2FxHCum96oxVnNr9zpCo:+rFz/q7PmyxL7tF4z+xY2if96oxVnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628625528, "uuid": "b568b96c-0673-4b96-8a6f-9a7256b70994", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628625528, "uuid": "78ef7897-59dd-4117-877f-67df132e9915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625528, "uuid": "910f187d-ef5a-4da4-b02c-37b5edcf1dd8", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1b9479-fa04-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618493, "uuid": "205ff927-2c3a-4590-abb7-21efb817ce3f", "comment": "Malware payload (Mirai)", "value": "ea25fd68221120c6c545091a70563e1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618493, "uuid": "d761db03-b602-4d42-95f0-1e5d376f0ee9", "comment": "Malware payload (Mirai)", "value": "cfbb4b632e53880d29fd2c017ff470fe7de50647795938fa0a22bd1c01745be3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618493, "uuid": "674fdf50-44fb-41e4-858b-2abb53fd0b7e", "comment": "Malware payload (Mirai)", "value": "eaae6cbc3ebd4cba954999d1653ad2856556e27f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618493, "uuid": "fa54bd99-f49d-4fbf-bb3f-fa586a14416f", "comment": "Malware payload (Mirai)", "value": "c12b026ee82b63d93371ab320e36b278c3cc09ac64d7e6a3317ed403c1b55beca2f3def18321f69cf119bb3fe0cd55b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618493, "uuid": "c56c3b46-8471-4533-a17e-8b3ac92b8c47", "value": "T111833CC6B841AA12C7C15573FB5F028D731A43ACE2EA33039D295F61778795B0E3BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618493, "uuid": "d39157fb-6ea1-45af-9f64-a577326f3a5e", "value": "1536:G4sSbL6je5p72iewv1ys6SkyRmwsOtLjO/iw69IjD6Bvx5hV:HsSbL4e5RvemIsEwltjwLjkx5hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618493, "uuid": "287dde55-9bd7-4762-8e09-d2b4519d9421", "value": 84860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618493, "uuid": "eed684ea-0af7-4b05-8e5f-b15f257ed5ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618493, "uuid": "a59ef52c-5adb-4f70-9ac7-d10c8162c554", "value": "ea25fd68221120c6c545091a70563e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259ba514-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586345, "uuid": "6d2571fd-a9b3-40c7-ba13-3882669bd182", "comment": "Malware payload", "value": "9433a2fc2bbac00dfc5e13d598e77121", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586345, "uuid": "cb2695a8-92bf-4767-a367-152f8dc8df7a", "comment": "Malware payload", "value": "cff98ca865a28a82198dd2e8614978011f29739691bafa2aef9b65c75107ef7a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586345, "uuid": "559c9828-5e92-4f52-8c64-ba3bec544e8b", "comment": "Malware payload", "value": "aa046c762b2f5ed74d620aca5bf42296f118c9b3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586345, "uuid": "b4f27764-fbd3-452f-ae74-7ea68cd34158", "comment": "Malware payload", "value": "a2460c4418649dc0e342b98d925b89f06c6d52a4dfa78916b66648134e6071d58e60b4444982dcf36034498cc9f9ed3f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586345, "uuid": "9c580189-fcc6-4272-98ef-f1cfaeb0c4f7", "value": "T1910412DF2DB92CBDDBB44D5D3ED2208354C078E8E77E9E81B417BA111BE11E40C2A296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586345, "uuid": "b7e717f2-1c25-4a6e-9938-fc97c21b8aa0", "value": "3072:9JHHNb4TTqz0C/5DxR465vvGPWfqm5dJ5lEIEi2/cImSe/mhLyn2JvDTHJgE0uJC:9Z9z7JtOPWf35lEPikmBKhvDTHynuOmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586345, "uuid": "8b7349cf-ea45-45a4-9ec3-4ea055e8fb99", "value": 188078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586345, "uuid": "f7f7dcf7-c05d-4477-8011-214552d72088", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586345, "uuid": "74971860-4039-4d03-989e-4a86f39e689b", "value": "Enquiry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1febbd-fa15-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628625521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625521, "uuid": "ced3a527-cae9-4c8a-a0b5-8475a6ce974e", "comment": "Malware payload (RemcosRAT)", "value": "182b36c3145e01799565e93c71619d86", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625521, "uuid": "01c0d206-a91b-4b64-a07e-a5af30c9c06c", "comment": "Malware payload (RemcosRAT)", "value": "d0732aedbe65944a77b053e11532b7df88b8ae0f96ed29d0f93683ff578c5357", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625521, "uuid": "98d4ca17-2b1b-41b9-8b52-ca0966bfad47", "comment": "Malware payload (RemcosRAT)", "value": "c6054e768f7bb27e4711eaf2f046b0ccf409e96b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625521, "uuid": "abf91a67-8c05-42cb-8f1f-96fae09af310", "comment": "Malware payload (RemcosRAT)", "value": "56da28a6d0e955562265290aa6006263eff8431dfe32268286cde86f6e7a106151526897086a7cc87bf7d445a1363722", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625521, "uuid": "88810ea7-fcfa-41d3-8e73-69cb6092cf1b", "value": "T17E8423F1C0E0632CED26D035E139A599AC5330D8E2FE219E53B783697F12E46541FA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625521, "uuid": "dfb5db12-c8d1-44a8-bed0-d5637f63aeea", "value": "6144:UeNgFZUVqXcH4z74B2xGyxLoYLzFHIXKKEsQZWoY2hxHCuY96oxFnNr9zpDemjuQ:j6FZUVqJPIyxL7nFEzWzY2uz96oxFnbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628625521, "uuid": "edf36504-fbdc-494f-9018-056a1de62d1b", "value": 390333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628625521, "uuid": "a68d42e7-d768-492c-bd93-4349d91ba62d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625521, "uuid": "744fb569-9d65-4c7b-a0ca-2e6e54bea41d", "value": "MT103.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70198d9-f99b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628573248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573248, "uuid": "9a370e4c-8445-4c2d-9ccd-f196fa1439b3", "comment": "Malware payload (RemcosRAT)", "value": "385e8a99e6a2b3bcec721e6109b69f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573248, "uuid": "717e8b9a-421b-4b41-b41a-7a8b010c58aa", "comment": "Malware payload (RemcosRAT)", "value": "d2344e95f3ac2babce42456613b46f4b348dbb09f84014675ea79feb7fc0d807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573248, "uuid": "9f26fc2a-300f-426d-b6c2-8346f1adbef8", "comment": "Malware payload (RemcosRAT)", "value": "7ae7b57466172033c6cf7036f5bb8e6130efb7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628573248, "uuid": "ead6594c-29a2-4382-858d-90ba2db12814", "comment": "Malware payload (RemcosRAT)", "value": "916a68a040b59c83830dc181589abbf3035b73b96924d2dac4c964eb3b33b659709ba2505787cd9141d1ae226c4aed22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573248, "uuid": "b107cd5c-b0c3-4152-a36b-0c95d5b64061", "value": "T1014501097AE1EE15DBD12636819B942C07A2E5177233F74F2F6CA2E95E433388C5A3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573248, "uuid": "9c969f2a-5ea3-44a5-8d40-6027f2c921b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573248, "uuid": "6b902faf-8b41-4206-bf98-8e3cba38966f", "value": "24576:zY4dtEE/9qREbrHRbtXSfkyWw7KeSNADeSUsViIP2xc2PR:hpaEHRhiew+rNADeSRVsxrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628573248, "uuid": "d3ce3cde-d095-49ea-9be5-d5c5efe22977", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628573248, "uuid": "a382e541-3695-413c-a84e-9540a3fb85fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628573248, "uuid": "47beaabf-0037-42d6-8503-8bc1f3a54ecc", "value": "Pictures.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a477f98c-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560788, "uuid": "0d8c47f2-fc34-4b33-b085-033df183ae02", "comment": "Malware payload (Gafgyt)", "value": "3c9b37358c9ff8378be20ad13dd08f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560788, "uuid": "4f0a27fe-2a8e-4ea3-9963-d14e5399ba57", "comment": "Malware payload (Gafgyt)", "value": "d24e1564cffc9c921184dc1430f89fd2b4ac077f941e019645ee3902ad8769bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560788, "uuid": "7fd6bd71-8b10-4998-9ab6-7ae1dce63725", "comment": "Malware payload (Gafgyt)", "value": "616b42054be91ede2c6f8f4e44c438ff33ef5811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560788, "uuid": "20d0eced-bc0a-428e-9427-2a071b134845", "comment": "Malware payload (Gafgyt)", "value": "b9357ad568ec7354bde22628c2d4a47318d4f1720698bdd6e77c21124407ebd6d6a005d781e057ff90069eb624834ceb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560788, "uuid": "2cc3f884-effd-4ee1-a747-dc6649756cee", "value": "T1BC933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560788, "uuid": "c8cb092d-c5d3-4926-8af3-426654624a1d", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8gl4umXxVqDrstKfz9e:Q97vk51RcG7A6l4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560788, "uuid": "0a1a8a2d-1857-428a-986a-22f66154e1f0", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560788, "uuid": "6bf9b797-ccbe-4dd9-a819-30999a00cb46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560788, "uuid": "d2168222-81f9-4301-886d-13f692a65146", "value": "3c9b37358c9ff8378be20ad13dd08f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df18d14-fa15-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628625416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625416, "uuid": "207b3a75-1560-4acd-8d75-af5af9cd162a", "comment": "Malware payload (AgentTesla)", "value": "311e5d4b29c7cec0379e38fa14b1684b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625416, "uuid": "a441baa9-b747-4e82-90d2-58caa764feee", "comment": "Malware payload (AgentTesla)", "value": "d25c19c347dd7e937043c01e75f1997214d972e6b085ad5501fd7772a564ac6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625416, "uuid": "c7e33711-497b-4faf-ac9f-70e42987baa1", "comment": "Malware payload (AgentTesla)", "value": "b37eeda08da3937f07a99843e9542b2f21c93c99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628625416, "uuid": "19774dfe-f20f-410e-9def-42c38a1b6d21", "comment": "Malware payload (AgentTesla)", "value": "3b846a8b55ce313ef30012faccddd8e985e1340a6bae581ac6f3d0e8236ee533e94ff23d8ef5bb86a883db9c0cb4f040", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625416, "uuid": "5f9b30a6-b8d0-40b6-80f7-1c68e7cbb1c3", "value": "T1CEE423ABDED6AB8B7B6313BCD2A21634553F41638A81FF386037D1D23C554E4805DA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625416, "uuid": "ed3d7583-4dd9-4d99-97c3-c1da5653161d", "value": "12288:KTXvIsLz7e+Zy8CwCXGGVEbbKCyZ58VFp5MA9loYk84Xdry0rJ1MF5hsaGNI7KU+:KbwQfBMPwCXBEbM2VX5n9lCJNrJ1waa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628625416, "uuid": "a474b9c7-7448-464a-b0c2-b102f5ad3d7a", "value": 701808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628625416, "uuid": "e5ac687b-7731-44c9-8299-0fd132776bf1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628625416, "uuid": "61b07b53-99cb-4fbc-8739-0174b7b941c5", "value": "Vk6NVzcmOXL1ic5.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6dbb21-f980-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561476, "uuid": "bf973a3b-b791-419a-a0d9-386e5e46a2ce", "comment": "Malware payload (Gafgyt)", "value": "e866170b05a7d8ca5acb4fc5b5a7de68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561476, "uuid": "1a5ade9d-9b5a-42d7-8a81-fafb29cb85af", "comment": "Malware payload (Gafgyt)", "value": "d2cf174169466d759b85f9ac3f8a6d63bafe294922daee5a56fd8aca552c3eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561476, "uuid": "20daeb93-2368-4a4f-b417-f7dba26354b3", "comment": "Malware payload (Gafgyt)", "value": "da5a4ed6fd29e3d385ec219426efa2126191d48c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561476, "uuid": "60cf1136-74e1-4353-a193-0de1b6dbe14e", "comment": "Malware payload (Gafgyt)", "value": "f557250f5b717eaf34d247e9649215dcfb1e2940bc1daefb82688b4c8751217858e24803d617d144429bc5d8ceafad7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561476, "uuid": "34397896-edd4-4797-bdfa-f50b6ece7219", "value": "T156C32A04F9018767C2D327B6A68E474D3F3517E453DB33166A38AEB42FC2B992D25E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561476, "uuid": "702027e2-55df-46a3-a5cc-3f30887d73c4", "value": "3072:jogfqPdx1YA2BFhGS5iqvIwLmUwrQRhk4rNXhLe:0Pdx32BFh15immUwrQRhXrNXhLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561476, "uuid": "5a7cc552-3421-4bee-9f45-ded82616ddee", "value": 125549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561476, "uuid": "1d2630a3-919a-4f1d-adc7-f12207828778", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561476, "uuid": "a4503295-8ff1-4bde-adea-40788e5dde1e", "value": "e866170b05a7d8ca5acb4fc5b5a7de68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473855d8-f9ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628608306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608306, "uuid": "777d469a-0e88-453a-a26d-3f4a20859dd2", "comment": "Malware payload (TrickBot)", "value": "7159ed58a04b00bdf511d809d32d0bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608306, "uuid": "21205b5c-56b3-4a8c-a3a1-17a421ac93a4", "comment": "Malware payload (TrickBot)", "value": "d33ee39ed2df3846e899bcfb8b0d9a4662ad70472b0f13c7662c7e48fe677aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608306, "uuid": "6301a499-8244-4a64-9dd6-8e47f0a962f8", "comment": "Malware payload (TrickBot)", "value": "2c31310e676526dfc5726782c02a47a68fd11690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608306, "uuid": "9a289784-665b-46e0-87e9-f9063f6f228c", "comment": "Malware payload (TrickBot)", "value": "a042134c243630a1f87ab696501a63004eb6addb2c642e6543fa47e29f9cb67830dba3389def7a113aacbc24a38a5a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608306, "uuid": "6e851e52-340c-4c78-b109-eae1fff96df5", "value": "T17194E1313280E472F163107489AA8ABD5AEDBCB04B6015D777D42ABE0F747D1AA3925F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608306, "uuid": "134511ce-1417-43b7-b219-f9b8fc538efe", "value": "e0b50ac12e1dfba4d95affb2dd541de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608306, "uuid": "43dff7c5-6ed0-4605-9d48-740388e5986f", "value": "6144:zjrzNW0NujooVXFcYqzygIWertnNQrmBPHU6fGkY48Y9sO:000ooVXFh6yBnNQrIPNGkYLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608306, "uuid": "1a71cff8-6b12-4d91-a672-1a6282729f0a", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608306, "uuid": "135ddc46-0398-4307-95ba-88052a8cdcf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608306, "uuid": "0aa2d806-2130-4223-8f2c-edd8a5541b54", "value": "7159ed58a04b00bdf511d809d32d0bb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bc0e76-f9f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611496, "uuid": "19090a08-56c8-43d0-9b69-53095ba48a0c", "comment": "Malware payload", "value": "78b2374d9d1810345aa8633ba8282a57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611496, "uuid": "cddb54bb-03a9-488f-b88d-7345a2718700", "comment": "Malware payload", "value": "d4ac60606ebb8df8a2b8d311c9262442978eeb65067e8940283e3a132efb2525", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611496, "uuid": "6987847b-7957-47bf-909e-3a8bdafc5e73", "comment": "Malware payload", "value": "4661b629995f3c4110b66afd4df827870923e47c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611496, "uuid": "d1237cc7-9640-4c6d-a5b1-519099f3ed3c", "comment": "Malware payload", "value": "d54863e38c685fdb1b7136ef4ef04531ea30441d6a07184dc09bf34cb609cb0ab86e60379a5a5ac9cf4d77bc2ac53b30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611496, "uuid": "dce83368-1798-44f0-af70-86f8c5683fbd", "value": "T12CF41252AA57D222CAC88977C0C76C7C07A2EE437626C55336CE3F093536BA97DC990D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611496, "uuid": "d6dff79a-7c18-4228-a193-7f267082ffdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611496, "uuid": "d0579c7a-3e4f-477b-a16d-1a137feddaa9", "value": "12288:+4JQ/AKt4AXV5nLrrxeK0wBl7zCzbJqmyegzGHFWGpqqENvK0rCIkEytW3spU1:9J+tBXV5n506CzvgyHUu7ENy0rdkEk61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611496, "uuid": "6caab855-af8e-4be8-b606-7a2d65479f30", "value": 758768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611496, "uuid": "d2de52ca-1616-435a-a3bf-56cc68151b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611496, "uuid": "724ea010-6ff4-4887-96b8-857f8a298734", "value": "78b2374d9d1810345aa8633ba8282a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145c930e-f9bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628587175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628587175, "uuid": "02fc2051-8ca3-4da1-b8d4-c0f93c9d3032", "comment": "Malware payload (Loki)", "value": "9897f9799f1940f8fbfa9f8f834a56a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628587175, "uuid": "6571faf9-e8a0-48fc-aaaf-eff764aeda9a", "comment": "Malware payload (Loki)", "value": "d53c000e6357eab6d6178795977ad7f6444490e93daf8258e15da75c68dec870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628587175, "uuid": "efc2e4ba-8596-4ddf-9071-39e0c7078c54", "comment": "Malware payload (Loki)", "value": "168a1a15844295697d6f9af5ab06815d3d500700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628587175, "uuid": "84f638ec-8168-4921-9a5c-766ca1f0a845", "comment": "Malware payload (Loki)", "value": "973b261b65c867e9f820b730b3446c6c7f5d6d6939275d2c76a0614b5a7a404df98a22249bb76e96a5f3faaaa7c9d36f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628587175, "uuid": "e007565b-12f6-4678-87fc-a40a5059a99a", "value": "T17045AEB11919EF22F4B706BC7872565442B48D46C9ABC768FE7332ABCD70FC23456A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628587175, "uuid": "a8a9f885-5ece-4034-a7f9-e30b9fa3c12d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628587175, "uuid": "5808b22b-5d6f-4339-934d-c9dbbeb4c1e7", "value": "24576:V2w4OsBgo0q4wMZBmCmTOUd+L6k+XWaXi5GeSQKnWpGWl6H:HZoHMXmCm6Ud+z+XJcGA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628587175, "uuid": "25adae19-116c-4b7f-bba5-62fad3e5e4a6", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628587175, "uuid": "fd5d0a87-51f3-4319-9020-ab38dd39b800", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628587175, "uuid": "80b82015-0180-4e1e-8416-c83bf663ef6e", "value": "Product samples.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea18833-f9ec-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628608103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608103, "uuid": "46c6fa85-7330-44a8-9cce-d61d8dd513f8", "comment": "Malware payload", "value": "8e2232a1475715afebd536b32e29fba8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608103, "uuid": "4fef2cbf-1659-45cd-8f5a-ca6cc06c1494", "comment": "Malware payload", "value": "d569d16d52c76b2aab615ddcb5ec7dbc076b4d03ab2f6e111e3fe3d61e108686", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608103, "uuid": "71dbd94e-5000-47bd-b5fb-0d4fb8c54681", "comment": "Malware payload", "value": "6f9766461152320363a8770a5675bbb52c7d0eba", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608103, "uuid": "9c4b9cbe-b2e3-4f0f-8fdb-37fcda0a3d95", "comment": "Malware payload", "value": "540849be936e9cec723337e834c10eab8427e7ddc04745981ad15b2307da1118bc38f9f9519146e826d583d62437ed5d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608103, "uuid": "03009f44-9b53-48ed-a048-e6782bea8b94", "value": "T190448D0673C94679E8E70331679BC322DBB6FC3486238527568A760E2DF1594F6633E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608103, "uuid": "4807b373-039c-4e71-a45d-322526e17fc8", "value": "3072:RzD5FT0xcM9a3DUY5A2U6ij4qpXqnnDibAJBVkMRz2L9rQn4J9+3Z5yOV2nWW:V5qmZ3DUY5A2Tqp4nwE5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608103, "uuid": "3b74493d-111d-48ac-85ac-4b2e422969e7", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608103, "uuid": "4deba328-d869-4605-b3f1-852419683eda", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608103, "uuid": "b3a0c3c3-38ee-4543-80f6-3cbdbd3dde1e", "value": "minha-conta-13082021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428203d8-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603144, "uuid": "b15436f4-9386-437b-aa93-4e2729f9bf92", "comment": "Malware payload (Formbook)", "value": "5615be335807b5eb2d4c9f59f5f914dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603144, "uuid": "d8fcccb6-e631-4839-a13d-48bc1ae44694", "comment": "Malware payload (Formbook)", "value": "d6b9ef1899c1b113371f34db9d306763e20d9dc759fb9975982a53e6a11b1f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603144, "uuid": "b6720c11-0342-40ca-97f6-e437c4e168e0", "comment": "Malware payload (Formbook)", "value": "8c4dfb652aced72e0fa9630f8b0146ef9f80dc9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603144, "uuid": "40c91cb9-d3f5-4390-9058-5eb2a5c2a4c7", "comment": "Malware payload (Formbook)", "value": "d0ebe458432451d60efb2472a61dc148096abd28d743b2ed4cb69e6c0d95ae8c2f61487750cff41a982177f9992fdb14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603144, "uuid": "66b3f5eb-25d0-4354-9db5-75a6428bc337", "value": "T19405CF1B77849AB7E1164F76882E21A403E1DD376136F72F24D876EA1C71321829F62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603144, "uuid": "3c3f024b-ff2a-4b56-9b15-cc484205b9ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603144, "uuid": "00816798-6361-41ca-86b2-773f83de9dcd", "value": "12288:PEQoWX2y6qHcwTeGKJEq/y6INX6LRgU7e9gl8YWvroHcHuPJnBOUu7+OrFjL8DP:KweGq/wKgDefLbt2+OrNcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603144, "uuid": "69a15d4c-bfe3-4a94-9672-19267b268d1c", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603144, "uuid": "73667685-7524-4bd9-87cb-c580810b7ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603144, "uuid": "70599690-e9eb-4cbb-a118-67b07d4ca227", "value": "5615be335807b5eb2d4c9f59f5f914dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a355a6a7-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628603306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603306, "uuid": "28920572-373f-49d5-b449-c7a404edb885", "comment": "Malware payload (RemcosRAT)", "value": "febb47ebfc843b8152c26ab3382ea059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603306, "uuid": "c1b9976b-d7b3-4402-876e-198b28f1b00a", "comment": "Malware payload (RemcosRAT)", "value": "d7511047d6d0127108e1cf026c3a8c7d5dbb860d62722371d4c3f65c3c1dc920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603306, "uuid": "f35e5851-430a-487a-b242-a1d9b7e05c46", "comment": "Malware payload (RemcosRAT)", "value": "ae01779d928f053c997e536b073f2ee4ec034b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603306, "uuid": "2cefeb75-a91b-4f1e-a827-b02152bfce28", "comment": "Malware payload (RemcosRAT)", "value": "45e8e9e44705e7df16b2f9b75d1e7f9368453aba0572dd6623a1c719162befd832a452d784d6432e1f865e0144814a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603306, "uuid": "182321e1-e13d-4dd1-8a17-da33ac752f35", "value": "T1B445124723809373C414AB3A149AA3874670EED4DFA2EEE9BD413A2D1DF6741CE06797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603306, "uuid": "aed92ce6-85a6-4b12-9dca-17a6044743e7", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603306, "uuid": "e5f4821b-248f-4f84-9c20-6c7d54df3bdc", "value": "24576:dKpPp9AR95ykxiTXesSdJwjG1XaD1dv2delN/KHoaHEnj/a0hR9:6PpKRykw8dCjEAdv2Y+e/tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603306, "uuid": "a515270f-617d-4259-b087-b9d1cc2162e5", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603306, "uuid": "26eb9d69-b0b2-4f12-8017-5d4403a48429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603306, "uuid": "44798bf0-9657-4da8-aa94-54ceb3dbe03b", "value": "febb47ebfc843b8152c26ab3382ea059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d608873-f9d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628599619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599619, "uuid": "c71f404f-b2a2-4569-81e2-3b2f2d6ed78f", "comment": "Malware payload (RedLineStealer)", "value": "6a6b790ba618946c08bd3ce158523f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599619, "uuid": "dd51cf2f-879e-47cd-8b1f-0af919554077", "comment": "Malware payload (RedLineStealer)", "value": "d81fa7107a59c18f2cee98c1eba8dee5752f05700efb152f49eacca745eae3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599619, "uuid": "5265180c-9958-43cc-bd18-8f71eabe55c0", "comment": "Malware payload (RedLineStealer)", "value": "f97af346f035bc4345e9114a1a1dc5c44c207004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599619, "uuid": "1e2aa609-5382-42bc-b3e3-8e8ad52a5891", "comment": "Malware payload (RedLineStealer)", "value": "c2198701b5b630e9c629dc221e57407dc4c14d3af35fc1352e348bf0b1012a2d47ae396ef1fc669f1354b78f114f1a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599619, "uuid": "9a8ca440-56e0-479a-a7ed-2f660104aaa1", "value": "T1AC94AE30B791C034F5B212F845B6937CA92D7EA15B7450CF92E51BEA12386EAEC31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599619, "uuid": "062f84ae-3365-4bd7-b6ac-5b71c65fa627", "value": "cc4caabe2c1a9c923331965c9764375d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599619, "uuid": "7c8f9e63-e50b-457b-8158-fe2da7cefefe", "value": "6144:9gCJ35tjPxbTlV+Ro6NFkPx+I9r1rCM91e5ZmdQXZpPokW9PHxV8zjzV:55tDViRo6Nwx79r8YQXZpPo79PHCHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599619, "uuid": "bbd5817f-d9c3-4f42-9942-fd6c9db522ad", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599619, "uuid": "b5e8147c-906e-41d7-8684-1daf077804c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599619, "uuid": "4dfcb3bb-71f3-4105-aa68-a153c0494a06", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.24513.11264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf8dc01-f9bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628588802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588802, "uuid": "9605f0ef-2eed-401c-9d0e-ee707a8cbd8e", "comment": "Malware payload (AgentTesla)", "value": "c2755f96ce4a2d006b13a7ec453d3b7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588802, "uuid": "b1a735bd-c22b-4de1-8b4f-47022e365dcd", "comment": "Malware payload (AgentTesla)", "value": "d8931e5d7a8cf4c6a8956b891ae8bddf6f5c0f7f525a89798dbc220262956407", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588802, "uuid": "42f44cbe-e389-49c0-83b6-420ad70094bc", "comment": "Malware payload (AgentTesla)", "value": "54722c12f80d622565095766d494c3fbe111f8ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628588802, "uuid": "66082830-0c68-4b8b-8524-3d13cec0ac28", "comment": "Malware payload (AgentTesla)", "value": "067e9a245b863aac4b084435ed0c1402446d3eeb5e49cf528ccc039b2cb9e15d849b0e6d2d2ca580c22fb892d2a0122f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588802, "uuid": "8c6b4049-b300-478f-b4d7-7cbe7419c717", "value": "T10415024723804393C415AB3714AD639307B5EAE9DBA1EEAD3882752E2DF7701CE02B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588802, "uuid": "a94d64e1-b895-4520-b873-a839ed341356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588802, "uuid": "4f4ef438-1b8f-4c0a-bddc-35428e394fea", "value": "24576:wjKcPp9AR95ykHaSX9v7/XEe4pjv89Dwcw:OPpKRyTSNbCjmDwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628588802, "uuid": "e514f75a-2277-426f-b3c6-c3c6db38fa2b", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628588802, "uuid": "16113d7a-be7a-46f0-a3f7-cf4b4a188f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628588802, "uuid": "e6254456-8065-485e-85e3-f8d409be0796", "value": "Best price offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bfdddd-f9d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BankBot)", "timestamp": 1628598183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598183, "uuid": "5e60fee2-c469-4568-bfd4-4d3c1c7d7483", "comment": "Malware payload (BankBot)", "value": "e64e9fc94ff0b95e5c0cf2b38be94502", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598183, "uuid": "347ff694-164d-44da-a165-9d55f58453db", "comment": "Malware payload (BankBot)", "value": "d97aab6e351401596e170f056c3833bfd709cf44a2db97739a9129910fe2ece1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598183, "uuid": "28ab45ff-b7ce-48e6-ae0a-0f055d0729a4", "comment": "Malware payload (BankBot)", "value": "7c9861d9fb7b00ea43113d7a36902b2c2525a1ee", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598183, "uuid": "867cab6d-21f8-4345-a09a-e2eb51f5d985", "comment": "Malware payload (BankBot)", "value": "581d884ef90b42c987bb37a35a94d244e164262d09f096cbdec8bedd197b2c26ea47952b31208ecce83250991bc8cd18", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598183, "uuid": "d325f90b-5eeb-416c-8e55-9d5f9b61b439", "value": "T117E53311CA87C085DA63B870C1A14D46C40A844DEE62FDAF0EC79A6CA8E6FD4D357BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598183, "uuid": "bc23ac27-d795-43a8-82d5-2b9a779c9eb9", "value": "49152:YR2dtusPvSD0goCVIvBN/wVIxFeLuZtRqG69FF3w67KDzCxTn5fl3MHOL1:YR2dtlPqD0oOHwGFttRqlvd7Xhqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628598183, "uuid": "71deaea5-1b16-4e68-a1f7-c945aa34b355", "value": 3259143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628598183, "uuid": "9d24684a-cc0f-4b25-b28b-0e610d1b0c50", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598183, "uuid": "4efca0cd-34c5-4157-834a-e68674cf3866", "value": "90635_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555a11cb-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628574399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574399, "uuid": "c09d0f19-82ec-4b57-a4b1-319b91f7b403", "comment": "Malware payload (AgentTesla)", "value": "76a85359a3fb6c8352cbb9eab578dee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574399, "uuid": "70ec43dd-a574-477e-8a0d-a7dcc2509690", "comment": "Malware payload (AgentTesla)", "value": "da6fffa759a427c9812725656112e73e8612255129cc639a31ba09ad96342877", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574399, "uuid": "a859d155-1351-4af2-829a-69185d950f63", "comment": "Malware payload (AgentTesla)", "value": "0ab66092f56fe9d01e50db4df2c506b21ef6ee20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574399, "uuid": "28f1d41d-364e-453a-ba8a-dcc56d2032f6", "comment": "Malware payload (AgentTesla)", "value": "1e6b76401a9160304e21f19dc4cded759deb7b45dc05fc26cc22adca74a768bd301646024c38cd0f0248ba2c1c7c94aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574399, "uuid": "83afc911-fcd4-47fd-9752-80bb20effadd", "value": "T138F4D0212B989F52F03A97798160604243FAEC96E732D98D7DA535DA1E77B80C373B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574399, "uuid": "9ef2e87f-b1c0-4f15-8ca4-1df1c74d7d2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574399, "uuid": "132d18f8-642b-499e-9bbf-93f837331d70", "value": "12288:gtTk4E9YztL96v+nANmnh6vGY6sAL3+GHgKlbCcc0HK7zZ5dwAhJuAR1zYgYMGsI:YAMh6jAr+fdfwCXb0gYMHL7vVOQWEfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574399, "uuid": "6259362c-e9b9-46dc-a756-58f80819392b", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574399, "uuid": "74c89178-eed9-4bff-91da-b841d2139939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574399, "uuid": "af01061f-32c7-4826-843c-aa6cd8c9fedf", "value": "DHL SHIPPING INVOICE DOCUMENTS.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370ab46c-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603125, "uuid": "34f98fc5-2f2d-4b32-a096-e4a31a776f45", "comment": "Malware payload (Formbook)", "value": "60c1e3543bef5489370f880d332f2358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603125, "uuid": "dc2d9f52-18ed-4ccc-a9a0-f140fd59ac4b", "comment": "Malware payload (Formbook)", "value": "db49dbfeed349b8c5ac59aab65bd065a7e9d90a1a45bcee96301fae6cfd508ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603125, "uuid": "d489a9b0-5915-409f-a22e-3bfa37c8ffaa", "comment": "Malware payload (Formbook)", "value": "c6c84fe8b32dcbf8fd8ba7da133ed444d6598bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603125, "uuid": "c49134e6-f0c7-4d6e-8e97-ff04d931403c", "comment": "Malware payload (Formbook)", "value": "af7ec86c62bcb7d8a1da9cfbde90d0f00c6aa835eb45b6a267f5ef06a6f6f30e7c8561c6ede7ce9a77db802bb1de2f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603125, "uuid": "9be17412-34fa-4b00-b14c-5867650b4b34", "value": "T11805E0663745FB8EC53F0EB5D4029510DBE0E6B75203E7C73DE219EC1A8EA9A4A23351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603125, "uuid": "42fb83db-e3dd-43d7-9d2a-0037e6af6d17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603125, "uuid": "3113571b-e80b-4a06-88a7-d8ebd7ae8fa8", "value": "24576:t9nGW5brV2HONizwaqD2Ip0ASwVPu00pji1BLOUAWFxu:tj53VN0w2Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603125, "uuid": "9b1f7ccd-d2d2-43bb-9a7b-e2b0583e52fa", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603125, "uuid": "999536b1-137f-4d71-a3c5-0567bcb6aae2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603125, "uuid": "82383fdb-c14f-4519-851e-c8d18c845b92", "value": "60c1e3543bef5489370f880d332f2358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046deaeb-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628581135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581135, "uuid": "5ff75937-a14d-42cd-8a7d-25b8d64d5353", "comment": "Malware payload (Smoke Loader)", "value": "e8b57e9e156ab02c1457cebbc8f0333f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581135, "uuid": "38b5e4a1-c674-4aaf-82f3-d86e683b57d1", "comment": "Malware payload (Smoke Loader)", "value": "dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581135, "uuid": "ec9004cf-5cbb-4add-a6ed-870c3b3b5f9f", "comment": "Malware payload (Smoke Loader)", "value": "1c2d52a55d84472067081a9e5b054f1d0dc7c35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581135, "uuid": "1891b80b-9e6c-469a-b32f-d04c886b54e5", "comment": "Malware payload (Smoke Loader)", "value": "6c180faa00d7fe28f368d00d48e8e16e7bef9adf9608aa94e538d711ee5f6bf2017c35ab83cdb3f182eef2ba98a78d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581135, "uuid": "06c750f2-6229-4522-b624-4e26ebff3c8e", "value": "T1E8249D3136D0F8B1F4974930746DDBA4FA7AF8216B20414727A83E2E6E733D0576A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581135, "uuid": "02f00d61-032e-46b5-afc4-44ffe8255e88", "value": "327ffb1cfc3c81bb8fbc4ec1e2259dc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581135, "uuid": "dfb10df4-44c9-44d9-83a3-1143a50e30cd", "value": "3072:G0CRrgZraEceNQ8X0jBnCst5suV7YWn7HwanCNeoBNTfC8IU:zZraAO8X0c5u6W7CIwY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581135, "uuid": "fc1547c7-1fe7-4fd3-881c-eca05d8df879", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581135, "uuid": "f0ce92e5-7f6d-47ef-96cf-8d0f02b34e97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581135, "uuid": "7e4d8bb8-57ff-4f81-9815-6e6693de8367", "value": "e8b57e9e156ab02c1457cebbc8f0333f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0810caae-f9c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628592308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592308, "uuid": "5f9404d4-b7fe-428f-9065-1a3e1b6a9ab0", "comment": "Malware payload (Loki)", "value": "1341ed3853e33133e80ba8ce87ebeebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592308, "uuid": "85416d0d-a8a8-4f8b-938b-0459760b69a8", "comment": "Malware payload (Loki)", "value": "dc0c244674ff2d063c77edd72795ce34db8fe4fdd054ce2a7b5018fb34adba4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592308, "uuid": "cad5b367-d760-4878-b2b4-871d9f3a48a3", "comment": "Malware payload (Loki)", "value": "5731e4858eff66a61cb2add852e61293c2ba5331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628592308, "uuid": "585ad6d1-cb28-41ba-9156-c0a185fe1ae4", "comment": "Malware payload (Loki)", "value": "ffed47ac0ee751364462db327170b12ece0f4d9726d048a527cf28f2b56daed94d5b9c87b92a65895adae0dd42fd50b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592308, "uuid": "c77ac12c-f821-45b0-9229-325b522d1531", "value": "T1D9A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592308, "uuid": "8fa27315-4734-404c-973a-b1cc430f26d6", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592308, "uuid": "9a545ed1-41f9-4e1a-85a5-75ed7b6d2ecd", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628592308, "uuid": "f6dc332f-ae1e-4173-b790-16f033af60dd", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628592308, "uuid": "1c63ed8d-0c1f-49d4-8363-13196a4bd041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628592308, "uuid": "8af00058-dfc9-4746-a0dc-cf02ab468f3f", "value": "Banking details for payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25feefdb-f9a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628576467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576467, "uuid": "408d1e56-9919-4687-a4b0-a8cc2247d306", "comment": "Malware payload", "value": "223cd0e05425a90526a13c19d26ab2f1", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576467, "uuid": "cc00aee8-9007-4a0c-b7eb-3118bd7f247b", "comment": "Malware payload", "value": "dc4c8d4c7836e303a096dc35c692d20dc92c1bf99cae8597c340d14fbf8119a5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576467, "uuid": "d70ab269-2fef-4e80-a8c0-8c1f9788ec81", "comment": "Malware payload", "value": "5749f2771d0fd50d0d57ab871fc0d8b3137c6c37", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628576467, "uuid": "a963d43f-b1d9-4622-9414-a1c3f013e644", "comment": "Malware payload", "value": "00cac38268707a23a2546d35c34f93da54e61704fb014a8509980db5424df7f9d75e7deeeff8a3f0a22325ba09894467", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576467, "uuid": "fced5f7d-af50-4d5a-930c-c825ff419925", "value": "T1724512CDD2BEF142EA8E327910179BAC852ACFC1B515D8872E733152B43F6D2139578A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576467, "uuid": "5d02ea9b-d386-4963-aabe-385c4cef9e4d", "value": "24576:YXJ/mVW94p51F5sfr+yK5rgfZxvnQQZ8At2FF72lQ/A+t5npF:0uVW94p51FRgfHvjZB2FF7U+znpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628576467, "uuid": "ff1c944a-f981-4f6f-a5c8-c891a4483965", "value": 1268136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628576467, "uuid": "d4b2be27-597b-40bb-a5f1-2f753e0083c0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628576467, "uuid": "e7024aef-1d62-4bf1-830b-a486f0403e54", "value": "SPARE PARTS provision.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f321df12-f9e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628605588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605588, "uuid": "295dd91e-a301-47b6-86b4-c945e5819383", "comment": "Malware payload (BitRAT)", "value": "aff4d9a6a67b7d617a353ea6ebfe7019", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605588, "uuid": "c5b678d1-92b4-445d-8f3b-6d932392fcea", "comment": "Malware payload (BitRAT)", "value": "dcb73a0ea23548167bd5724418377fe1e8c88f1be3125c0df6cc89722bb26f33", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605588, "uuid": "b4edf9b5-3b88-460a-9e08-c45dcf916547", "comment": "Malware payload (BitRAT)", "value": "986e51c55def0a78234ded145e6c318d87ec3914", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605588, "uuid": "e442ee95-7e69-458a-8843-a5bae7e3a247", "comment": "Malware payload (BitRAT)", "value": "bc7b645eddfdca2f65ea40ff75df98b14eaa5378de072c4564cfec32c2c25e61c503cf800a3abb69dd425da791a4d9d5", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605588, "uuid": "ac7637ba-e697-4421-a988-8ef58a118cfb", "value": "T190016D00B501F1F39105F747DDF11275A6E776A48891A591306C819F40BB46E3E83E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605588, "uuid": "d13430b7-96aa-49c0-a6b7-e4606692d113", "value": "12:dXVlTX7Fl9kQOGv9IXOMBN3747f+8irXWMMeRo8N5zliwqhP/jvVlg7:Tl7FeG9gOSN374aXLMeyMgV67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605588, "uuid": "6889d3fe-edbf-4449-9031-32f6f1bc614a", "value": 743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605588, "uuid": "5de0dab0-ff86-447d-b57f-597b7abd9977", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605588, "uuid": "874839b8-f9ee-4930-80e2-a0efaa0eaa38", "value": "FEDEX4100985675.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacd3e40-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628603319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603319, "uuid": "ce42a0e3-82a4-4d0e-90a8-dc9a8009c269", "comment": "Malware payload (RemcosRAT)", "value": "e92cb564767afb2d59b12ecfc97ed86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603319, "uuid": "8dcc3230-b0d7-4199-9dd6-96c4e78076e2", "comment": "Malware payload (RemcosRAT)", "value": "dcfbcb0018eb4a0bcca81d7990bde125541b7c9de20c16142ba46140261a0b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603319, "uuid": "e8961854-dc42-4a36-aac7-d974fe96e6df", "comment": "Malware payload (RemcosRAT)", "value": "27b7a3ed4038e40927edc4bd88fd58f80d178e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603319, "uuid": "785a4450-d53d-4db5-8f34-02da104635ab", "comment": "Malware payload (RemcosRAT)", "value": "fc8e94e820995df529df4f57d224fa9fda2e516376753771890ec21d844945c9bd4720f16581b9a7c253413a0eb15931", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603319, "uuid": "89704519-ed2f-4539-bf4f-b7d6a223e161", "value": "T126E48E27A6765E73C1AF193C8D6B9298692FBD152E188FC725F41E4CBD3A2842D340C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603319, "uuid": "b12bda5b-3c61-44e3-b3a1-083351cf7008", "value": "64b99ed56fe51c14a44881c90ac9ff50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603319, "uuid": "d5a5b293-1b45-4df1-884a-8f7e4611cdd3", "value": "12288:SnE1eDMrSuUFA+/ARNb43cRuM7bUwYgsI4pR8/CH3eVgfm+7p:42HfUG+oRNb43chyXI4pR0U3eY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603319, "uuid": "223b98c1-6c73-4db0-8c4b-b64b3edac56d", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603319, "uuid": "8e51b91b-39be-43bf-843e-fe15f923f906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603319, "uuid": "99fe70f0-20a4-47d5-8b06-53208a275d7a", "value": "e92cb564767afb2d59b12ecfc97ed86a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd092ed-f9b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628585069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585069, "uuid": "78245b5c-2cb1-4b82-86e0-43da664cb066", "comment": "Malware payload (AgentTesla)", "value": "799a082e08d8048eff25879b17c1cdd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585069, "uuid": "00f03382-5435-4586-9b6a-ec8f7743728d", "comment": "Malware payload (AgentTesla)", "value": "dd89bc056a16b90aaede8e70eede3d8b5523bccc86e8a0a6709ea91b99a7a2cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585069, "uuid": "5eed6274-beee-4101-bec7-f02ba15641d6", "comment": "Malware payload (AgentTesla)", "value": "cad490828a86a8fae803e6d41296a99735c27522", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628585069, "uuid": "c55a64aa-da7d-4b02-8821-d5539bff85a9", "comment": "Malware payload (AgentTesla)", "value": "fdb7e8743a5398bc6050f699ebf565677c9b5a78efdcc2fd8b5e5f4092602c8e267bb84bf9c545182c977e4c1cc5353b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585069, "uuid": "539680c4-e33c-41e0-a6a5-f43c426c95e0", "value": "T13805F1667A81BB8EC17E4E71D4565800DBE0E6776703F3C73DE305DC0A8DADA4A23296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585069, "uuid": "5af6633c-c0b1-42e8-9c8e-c197dbc75ffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585069, "uuid": "abb0549b-3a8f-47f2-8e75-47ca83787fcf", "value": "24576:0sp6TMofZJinfwg0nLK7Siub/hA4hENpPr/RWtIofU9bFLWoimJTq1ReM:0sp6TMofgf3GpOpQ/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628585069, "uuid": "4996508e-df64-44d6-9f51-c4f42e3c2115", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628585069, "uuid": "205f701f-665c-4c01-becc-5c1a30534c67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628585069, "uuid": "814f1ba0-b45e-42bb-8071-c6bf5d56c66d", "value": "799a082e08d8048eff25879b17c1cdd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78049567-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628608817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608817, "uuid": "c3d4fc14-6ce9-480f-b3e1-d97add9498d9", "comment": "Malware payload (RedLineStealer)", "value": "b3e71b5e973a42dc9f297f79377165b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608817, "uuid": "d5a272bc-42ef-425d-918a-a4f0e3218352", "comment": "Malware payload (RedLineStealer)", "value": "dd8accb35c4d3064543686f1f697b9e5eb4195fbefecef6f53e032ef2bd4395e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608817, "uuid": "1fdd1ff4-ac6a-4a00-a408-5c72bd176be4", "comment": "Malware payload (RedLineStealer)", "value": "a084d94b800a490f40852a42141fa8d56a7cb668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608817, "uuid": "0ff109bb-dd05-4591-96ed-fdb52a3b5501", "comment": "Malware payload (RedLineStealer)", "value": "42dd514762d062e4dc7230e30776d75797e7100700ebe119f39fa03dca8ddd447ad0a5d84c83f979ebf1b9bfab031628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608817, "uuid": "2f128d63-3423-43da-920f-923791e63e76", "value": "T13205AE523288DE96F0376BF2446ED06053F9B89FD321C60D3E827A6B59E7742216770E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608817, "uuid": "307e35f1-5f29-4a4b-8401-4d6a8484583a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608817, "uuid": "4c9c9236-9a4b-4ddd-989a-4640e15f3ddb", "value": "24576:MAYpW5I/8hFPJxKLxyEjI/2F69xgyd86:bFPJM0qDFmgyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608817, "uuid": "79209f14-1b4e-4953-814a-7564b3ed55c1", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608817, "uuid": "2d3deb49-8ddc-4127-a354-6cd1fdbe654a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608817, "uuid": "461b36b5-dbe0-43af-a389-e0a22d0ef787", "value": "DOCUSIGN_88902331765998762.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827a305d-f9b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628583065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583065, "uuid": "90012ee3-475d-4edd-a980-6759dd020076", "comment": "Malware payload (NanoCore)", "value": "f42e394da602e24e0caf22cc16b9a587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583065, "uuid": "25ce4b9a-9ddb-460b-9d6b-47034c32ac6b", "comment": "Malware payload (NanoCore)", "value": "dd8f89aefc7df0cae92af60345a0f467ef1ec14decc73ae24b355408fc8ad78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583065, "uuid": "d4622100-a7d0-4bf9-bdf8-1427a72b3c1f", "comment": "Malware payload (NanoCore)", "value": "6d8c11fa74903f18b6a222464a9f1a40f50dc347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583065, "uuid": "e8080011-fb1f-4de1-a24c-396850470063", "comment": "Malware payload (NanoCore)", "value": "c8de2093f44bce9977c3861461ea2cb9a2bf54b23647a1de464e04b2ce784ccfdaae7b189f038f2154f26f7cfb67ec4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583065, "uuid": "94a08783-c11e-4ff3-8bef-c4aedc96255a", "value": "T17F15F1757781FB4EC27F4E71C4426800EBE0D23B660BE3C72DE219DD168E6A94A63395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583065, "uuid": "c0c924ef-873a-48d9-9b48-330bb3d5d332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583065, "uuid": "827379cf-8793-483d-995a-6826a6cf8806", "value": "12288:BnMQQ6h7qT0zX8uMEptG+jvmSUdLDb6kaiEmfuAiweutmDFSxO4aP7chD9MMGbxo:BMDP/eAcU+oOutmZSIv7chD9MMGbxZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583065, "uuid": "74a63f15-d9fc-43db-9a7f-36762857f01f", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583065, "uuid": "abef7960-ade9-430d-9472-d83b27f67936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583065, "uuid": "2cb7577f-0e83-4390-849e-e07b03b3fbc9", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a127843d-fa05-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628618765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618765, "uuid": "25d91b63-c450-4f9c-bdcc-20770353d04f", "comment": "Malware payload", "value": "b28d42046580408265054e460886c110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618765, "uuid": "9db629e2-fdf6-4784-8cef-d68715ac1ea0", "comment": "Malware payload", "value": "ddde937fc1cac25ab3c8e7b91b4f074f8eadf1d39ca93c88be816441ee58ff41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618765, "uuid": "0c838ba1-914a-4342-9f4f-4584010c6053", "comment": "Malware payload", "value": "8b9c7909fb006c4ad3c12fab71eb04892ec61896", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618765, "uuid": "0f61bd3c-bf3d-4839-8a42-d12d35ed49fc", "comment": "Malware payload", "value": "735c0d74e0b6cf0df7b501f93c57120c23b23fc50f5d3d16467208df9f9d536c27a6b8e32708ad45c3b48bc0fb653e1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618765, "uuid": "d380f05d-bdf5-4d97-993b-c74e35c0a4d0", "value": "T148E4E130BB90C035E5F711F845B693BC6A2D7AB0973490CB52E21AFA57346E8AD31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618765, "uuid": "3a47dce7-0780-422f-8b1e-eb7f953eb63b", "value": "e3cf60b4d5be6f57956398dd6440990e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618765, "uuid": "70f9a3da-65ae-4118-bc21-62530a79a971", "value": "12288:cSgVVChs3tbgvLcFSXVqaGfnJStFnVkCxXN5Bj4OKRr3yPc/:kbcs3n9fnYR1xXzfKZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618765, "uuid": "03445b75-bf36-435c-a02e-8e0180702c72", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618765, "uuid": "4b8e4138-68f5-46e7-86f1-62defbcb0649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618765, "uuid": "78a115a4-fa29-409e-aa01-6d019e66bcfe", "value": "b28d42046580408265054e460886c110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031bd1b8-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628581563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581563, "uuid": "0593f411-4ee1-41f3-a52c-f87f1cb95394", "comment": "Malware payload", "value": "841182a9a275aef8c5e62cbf43050f01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581563, "uuid": "9f3e2e80-0d3e-4c37-b904-79b9659d95d8", "comment": "Malware payload", "value": "e07d31b0081ed774a0f8e76a21a07ad6f8cf0eff5ba6be28549e47a57692d060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581563, "uuid": "0f811e4f-9a7e-499e-bb9a-d37f9b272386", "comment": "Malware payload", "value": "d2801e9096470fa089358e4923ccea27f463dbe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581563, "uuid": "572f7ec5-135e-4c52-aed7-63ac68fb4f44", "comment": "Malware payload", "value": "b215d68bd34650ee69e678dc7ad55b46a65c0cacc70d7cbae7cb2956508483f92303c17368cecf3dc5a3e8f6557fd360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581563, "uuid": "0a3b4934-893a-4019-a52b-d731e1adafe2", "value": "T172733A56BC919A12C5D212B7FF5E4289372A4368D2FF32039D25AF2137CB46A0E3F155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581563, "uuid": "9691f824-2eff-4691-a640-e6afbeaf646c", "value": "1536:pHpgagPIIFC9E87YG8b3UMjRp6WJGSV+jOfOBKVU6VaMv9FJ:pHuaG/32YuMnnVcBKdZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581563, "uuid": "c9d3ac72-334d-42f5-8fcb-c957f2a9f89c", "value": 74908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581563, "uuid": "5c68080b-9677-4920-8e28-ac8145baae79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581563, "uuid": "a5c04d90-502b-4cbc-9dd0-31bdd4cea3c9", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.5705.10852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f3574c-f9f0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628609589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609589, "uuid": "5e964e8e-19ad-4a7f-9e21-ba23c9c71fb0", "comment": "Malware payload", "value": "47aa0605e29937bdc650b2afe028e5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609589, "uuid": "904d8b34-87e9-41ec-b0d8-e24a9ca6e4c0", "comment": "Malware payload", "value": "e08c7faf3ae6663dcf6dc39428ff5c289f5f77665dd32f1644633cc3dc9b5655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609589, "uuid": "32e6339f-ddb1-439a-ab41-8bcbaa8a964a", "comment": "Malware payload", "value": "bc644b36b1e0026cff29e835697e3714ccc29b1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609589, "uuid": "5581dac6-bb50-4a77-8a10-0c39d08db92d", "comment": "Malware payload", "value": "0a23a2216e52ef2e6b5d4a65e64a96b0d36577329267586daab109df23679dd864893a2bb9a0ce5e5d7afe8c97e09b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609589, "uuid": "3a100e03-7794-4350-8607-3eafac098a8f", "value": "T1D684CF25A441D073CAA308305AD9D6BB4A2DBE305F308DDBD7DA4EBC6F315E252247A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609589, "uuid": "160fcbb7-fb65-4d66-9a48-34a9ca0483f1", "value": "211889fbd769218c7de88e900b98c2f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609589, "uuid": "a8841c12-16d8-4e97-aea2-a2795f0ceea8", "value": "12288:qFSgGPbKhiIfh/wWsn7TQwSOZYhVFoLRcH9q7JR:qFSgGDJO/En7TQwSOZYhb2qw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628609589, "uuid": "5d1c147f-e9c6-4106-870f-59bd44daa7d2", "value": 404490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628609589, "uuid": "ae763574-1ed0-4f0d-bc96-545b86b447ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609589, "uuid": "f9b0c307-9ed4-449e-acaf-fa6398d6e9c6", "value": "Import Custom Duty invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616d31f6-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628603196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603196, "uuid": "974ce4e3-0d40-46d4-9c0b-2d06bdb89311", "comment": "Malware payload (DanaBot)", "value": "236b256c4b3847385c97017dc3e13321", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603196, "uuid": "05e6aa72-8b4e-45f3-8164-1bbad94889e2", "comment": "Malware payload (DanaBot)", "value": "e1739818076bcd954349e8ff0aa465fd980781a9e73c5048864959e0a3ca77b1", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603196, "uuid": "1d5226cd-13df-41e9-bd32-4abf56b8837e", "comment": "Malware payload (DanaBot)", "value": "0319e215cfbbeafece1ef4e53bf9ce51e236a7fc", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603196, "uuid": "421cbecf-4fb0-47bb-b817-e48f574fe9d1", "comment": "Malware payload (DanaBot)", "value": "94b258bc70ebbc6b56cafd901b901cc4a0857cb6048a06e54f0d181f9f86db52126b3fbbd03a2cc9fa4734e5c80d0134", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603196, "uuid": "3d566ea3-aedb-465d-bb79-94816fd7f6b1", "value": "T1C2451230A760C431E4B255F889BA93BC792D7BB1477850CB93E526FE5A246E4DC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603196, "uuid": "3398cd08-3745-43a9-a05a-3578ac9c339e", "value": "9e69c87bb37519c7f1f7d4ff41d9c1a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603196, "uuid": "eb3fe420-86f5-401c-866d-891f3ed04608", "value": "24576:7pqakfAoiWHIbsjF5nA2l7EuJeh9H3PshGsE0Z2rDK8:7Euo8OA2pBCE00ZAu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603196, "uuid": "5a3b0d68-7d2c-4dfe-a4ac-975cf07482cd", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603196, "uuid": "17dc3291-2d73-43f2-9db7-e9fc5b01c263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603196, "uuid": "94244108-0753-4db5-baa7-3764bc0b3ce1", "value": "236b256c4b3847385c97017dc3e13321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51816b93-fa02-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628617342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617342, "uuid": "131e765c-17d0-4510-9028-f67a38311aab", "comment": "Malware payload", "value": "168de322e54241e7b321dfe8fe588f75", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617342, "uuid": "253bf971-f23d-4fd1-b095-7b2aa059b550", "comment": "Malware payload", "value": "e1a2efc352e34661eddae757bc6d1856c64a6e0202ea8a427a3f237c4c440162", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617342, "uuid": "e0b6ecbd-08e6-4299-ba78-8e35087369eb", "comment": "Malware payload", "value": "96a03707a5f06f8bfa542c69a2bcce5e4cc9f5be", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628617342, "uuid": "cb31587a-9a72-454c-ab32-aa2210266c7e", "comment": "Malware payload", "value": "918cc349ea7b7b16da8e8d13c869c552c1bd119e86c37dfd4792b988b247f9a4b2d3943ebee5b88d4dfe1caa8ba7f966", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617342, "uuid": "50db1e5c-b00a-4451-be4d-8f7473802359", "value": "T1A365F11CFEAEE126D207E33DC162849B447802DE5904F92B5B75C49818EAD889747FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617342, "uuid": "dc069997-e52e-4b06-a933-363d502553f8", "value": "24576:VhJK1vvdMRk2UG8fHLUvZH/U8Cd91awVS1N7MmLMq9PNh/W:V7IXdKksCq6d96RMmLh9PNhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628617342, "uuid": "4767ed3b-d5c1-440a-882a-d8ba0c8e6c22", "value": 1522442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628617342, "uuid": "46515835-2e89-43d1-8ae2-31b1b66a6000", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628617342, "uuid": "25231892-2603-475c-981a-1f6e5a63a487", "value": "Kurulum.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67066156-f972-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628555531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555531, "uuid": "ea5234b6-230f-43b3-91d0-6cddbaa1ef8d", "comment": "Malware payload", "value": "1e53e517f725545603f1b75958ef7302", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555531, "uuid": "aeecb1dc-6a90-4305-8cea-9e8ab82669ef", "comment": "Malware payload", "value": "e1d7005f1e028d05f0c0ca13c6802fc06664e6c4ab8ca323d162a3694bc7ad0b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555531, "uuid": "ed9004b3-7653-4bff-ae3b-c4443745af75", "comment": "Malware payload", "value": "68c4c98f91f394dd9a7519df884c57e91f712940", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555531, "uuid": "879f5364-c598-4105-8c18-86039b643d8e", "comment": "Malware payload", "value": "cad814744d368f50f830bd3c3cff182b5cfcaf95988b031d8ffbe1e598c07c9b8b9fa7242f2e263e36afdde8b013cb7b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555531, "uuid": "348140fd-4579-4850-a6b5-38c2d763a9ce", "value": "T13F6423CB2B25BBFE642DD2AE4264472252CE2C937B5D3016AB5C9A605FD2C1F5E8C017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555531, "uuid": "f2f8faee-428c-4b33-b395-d3dcd4f37659", "value": "6144:yQWZu4ZETS3V82r02121M0FRVrn+yWYlX3EqnMFyR0rs8t:HWZuVSO2Z41M0zVPGWM4R048t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628555531, "uuid": "418fca9b-80bd-410e-876b-bfda52f351a2", "value": 320464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628555531, "uuid": "8031d38f-f03d-4729-94d8-cd9f0bdbd8c8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555531, "uuid": "5dedd8c8-ecf9-47b0-b94e-07a6c5ac02ce", "value": "Document pdf.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627c92ac-f9d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628596326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596326, "uuid": "ed5d4170-f8ea-4830-a033-1e916bb64a8f", "comment": "Malware payload (AgentTesla)", "value": "7cd70a21884cc27af8af68b3c507c255", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596326, "uuid": "87835acb-4d04-480e-995e-9187ccae4210", "comment": "Malware payload (AgentTesla)", "value": "e1fc52ea792d9cb049231354c4376f6a6c0ed6634f60703d53eb7366f8d34ca9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596326, "uuid": "1c824d23-62d5-44da-be88-5ab1d3d9e82c", "comment": "Malware payload (AgentTesla)", "value": "d27344f235177e46a53e249e83b4ad7160311564", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596326, "uuid": "4c836176-1b22-4e36-aca7-31b6ad47034e", "comment": "Malware payload (AgentTesla)", "value": "9518aa7bb418b610a19fd8b7e853d3050424acd33bcb8bfe2f85f3000b0da23b1e65ecd48f98923e6f51c473785c0cfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596326, "uuid": "95927103-2afe-41d1-b971-7fc4c16163cd", "value": "T1F7B40113BC184FA7C0714FF995E2C134A2BA6C50837AA28AF9F97D1AF7F6B501D55280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596326, "uuid": "1b1646e2-00b0-4351-a874-a825e46c213e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596326, "uuid": "4a9e3d10-3c11-4eec-84d5-0d019fc02bd0", "value": "12288:+ng2E6xSCM2girMSBXcNouHwb2XGkRxfBrgeokGLR2Cmu/eZM:uA6xBd6SlUoVTCXgnj2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628596326, "uuid": "8c46c71b-e92c-419a-95d5-c58285bed9d8", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628596326, "uuid": "530c6f61-d709-4c5d-854e-7731aae17459", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596326, "uuid": "27a3877e-11b0-495e-a0f6-983dbf9e6a5d", "value": "MV. TBN_VSL PARTICULARS - BEN LINES.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d79e9e3-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560535, "uuid": "fdb7d2ca-5a1e-4737-8387-4d6eff24c2d9", "comment": "Malware payload (Gafgyt)", "value": "523acc0d0bcad68e84ef53d9fcbf9411", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560535, "uuid": "4f15e64e-e6fe-4dfa-9ccd-6ecb49cf1771", "comment": "Malware payload (Gafgyt)", "value": "e23964f006c16ed365caa9ef140067c4da0c8102b05073c07a429e4c2849f487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560535, "uuid": "3da2621f-d691-4342-84f0-577b68e52ee4", "comment": "Malware payload (Gafgyt)", "value": "d2ed33a33f5d6ba2797c18e50dad3672ca6e8396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560535, "uuid": "2c80cd0a-9cdf-4640-a09c-4117831a1e29", "comment": "Malware payload (Gafgyt)", "value": "fce4175a66705549f1040811414563a03ae30829ea4ed64e16f4b894ce23641c459d934f8dba7baf137993c0f12df059", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560535, "uuid": "afe0de66-4356-4fe5-ae65-7b9ab8346e1a", "value": "T1B3E3A62E7E22ABBEE169823107F7AF70C79521D227919342F16CE6185E7124D1C5FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560535, "uuid": "294310b7-e47f-4b54-ab9f-c1dfee20e2c9", "value": "3072:1Atu6SxI/5ZIUj6QP/5NOX6sILJ+DAlwgqVIiFhq1TB3OotUmkmZF01TpM2ke:omclhiFhqfUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560535, "uuid": "f1ee77cf-e5e1-429e-97cb-9dbdd9907aef", "value": 146926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560535, "uuid": "e1315d8b-ab20-4bdf-b226-6252d321a693", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560535, "uuid": "64cccd2b-d662-4ba2-96a1-e2044a3bc557", "value": "523acc0d0bcad68e84ef53d9fcbf9411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da550ba4-f9b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628583642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "ddc460d6-e420-471e-bea2-3819ef1b382b", "comment": "Malware payload (AgentTesla)", "value": "2997b16a11608ed2c2080e856ee6f32b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "e185a8d1-c4d0-4cda-a532-e722603b7075", "comment": "Malware payload (AgentTesla)", "value": "e27d857d1a1c5e54a63b3a367214e52d9a3f319b8488df90ddd17de66187e74d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "c2eb3f42-267b-430b-bc58-659ea9c0cc57", "comment": "Malware payload (AgentTesla)", "value": "a6302d34aa6ad3fb5366eb4523fc6b6a46a99563", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583642, "uuid": "7c37c1b4-0770-496c-890d-f2ef7c5c5bf7", "comment": "Malware payload (AgentTesla)", "value": "e217f0e8eadb44ff22c57b3cadd936232eada260ffa1eb79d57aaf074696a7d817ddac90fed4806dd3d1ff3afc05079c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "824f00ce-f742-47d0-afc3-54938b8354db", "value": "T187E49DF595404DA3E63AE272C476EA01FFE469D2F280CE0E9297B5931E62213549FD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "64b8954a-fb84-4c53-9279-18796436bebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "e3d751da-e06e-4f16-9848-3f94269efbef", "value": "12288:yjOhHOcufmspkmWGWfAECjP5jYhW7frsfEEJ9fhpeepZYmCC9jB:yjqubWm5WThgr657Jru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583642, "uuid": "9a9413ea-9578-418e-81bf-8bd5cd606d89", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583642, "uuid": "285e62a2-4971-4ed3-ac4e-53890e9f7143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583642, "uuid": "115589cd-ad35-4fce-a403-0811fd73b7cf", "value": "INVOICE #2626223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d54a72a-f9a1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628575782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575782, "uuid": "ecbe6e25-e0ec-4ae4-909d-a4afe96d9098", "comment": "Malware payload (Formbook)", "value": "19e4c0e192b1966e105f7cdc815d4861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575782, "uuid": "e830740f-ed8e-486e-9e62-5d9e53e13a32", "comment": "Malware payload (Formbook)", "value": "e2ab98687c215cc7f4e84d11bdcc6a83d797944132901cbbd6b1c23a47efba08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575782, "uuid": "22eeecd5-93cf-4b18-a1a2-db3cb79efbb4", "comment": "Malware payload (Formbook)", "value": "201261501086a6ca7511206ebf17232af50706b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628575782, "uuid": "c09f37c3-22c0-445a-98b0-201dbe0521bd", "comment": "Malware payload (Formbook)", "value": "3cb0024968e9b1355d7a4ce20566ab25c9ca999f3b2a544a25bc89a81a4153ef3499e249f43d83b64ff351295c08a81d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575782, "uuid": "64de4312-ad1f-4052-a460-40a9680cccb7", "value": "T17015F1472F9082C3C4159B3A18D9A35607F3DEDDEAA2DDD97982352A2FB6700CD42B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575782, "uuid": "6346c88e-52e7-42a1-92eb-498101afec5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575782, "uuid": "abfeb6ab-31cb-42e5-a898-97f9a6e2fc76", "value": "12288:YVqGUslKAn3qGaNHEyC9/oR9gy5FHK7zcRLL+UVdgYjksp/4e6xrZ9dh6tLxgvvl:YnKAPp9AR95yOLL1jkwg3xVl6tu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628575782, "uuid": "65a0ca1c-b4d2-4222-b78f-94fb7f8a1ad3", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628575782, "uuid": "26e6535f-5b6c-40f5-82ff-12537293fee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628575782, "uuid": "297c49ac-a13a-46aa-8a86-83a9b4209a55", "value": "Details for valves quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7528b664-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628608812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608812, "uuid": "168810bc-fb8a-4bb9-a360-9701d3a9f6d2", "comment": "Malware payload (RedLineStealer)", "value": "ab303da731cc95c5118ed3b381c417ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608812, "uuid": "f0e27f4f-e66b-406a-ab66-ecdacdc78253", "comment": "Malware payload (RedLineStealer)", "value": "e2dba259192d31594e6352774f189b38d680789d8a481a8d873d01d89f20d23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608812, "uuid": "6210b911-f8b0-4fef-90d3-a3bec55cf041", "comment": "Malware payload (RedLineStealer)", "value": "724ce3ba4cbee36fe6a90f9377aa4455fc5e8e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608812, "uuid": "91cda55c-de13-4b95-89ab-972204dc980c", "comment": "Malware payload (RedLineStealer)", "value": "2a8e6ba5788d9336f5e4d5a41d0a8781e102cd34098c545b366029806927af47b52aa8f5241421148bd259470d7b3ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608812, "uuid": "427f5a2f-82e5-4e83-9245-c56ab2f4c9fc", "value": "T1AB24F610F6A8C558FEBECB31647148251173BD6FA471A20E2EDE30AA2F7B3C16159D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608812, "uuid": "7183a07f-1ede-474e-8d5f-51fdb11d7b11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608812, "uuid": "02cac874-4275-47f9-93c0-8935c667cb38", "value": "3072:6i86AdOC6SfPCSeQz2kT3LubyddWsvE/sB09pX:J7Adr6iNe4Sy3ksA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608812, "uuid": "9a1a1712-84b1-4242-be68-320861964c89", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608812, "uuid": "488d88a5-f5d4-4bad-b02f-49f0bf977585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608812, "uuid": "cd9f12d1-4128-4a83-945c-1a06c25b84ed", "value": "DOCU_SIGN09984027329010087PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad77e5ab-f9d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BankBot)", "timestamp": 1628598169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598169, "uuid": "6a877951-bb21-489d-b270-ddd6174750d7", "comment": "Malware payload (BankBot)", "value": "8a8c858f34f3b62bcafb61154743131f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598169, "uuid": "e06faebb-d21a-48ed-b53a-efca42d3fef4", "comment": "Malware payload (BankBot)", "value": "e30a471eb9b435c0bd1c0cd077b3ff78f114bd77cfe922f061b09d6a2ab34ff5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598169, "uuid": "0542c2b4-0030-4833-beb5-ddf9a62e8586", "comment": "Malware payload (BankBot)", "value": "16676b0251e8994c407102226163423e57c57e72", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628598169, "uuid": "d8c0592b-5ff1-4117-bafb-a54623c8235c", "comment": "Malware payload (BankBot)", "value": "ec1b573c5ca9a2f936dc11614483cd9c59781a7c4b219f382906e74390fd57073bc58716560a0775c0e2eea0602ca242", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598169, "uuid": "60743c89-425a-46df-8019-53479a975f88", "value": "T175E53302D974E012F53F91F30294DC595A17628CAB53AE3B167033CA9C82FE1A767ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598169, "uuid": "998718d9-e2aa-4c8a-b349-3944fe6337cf", "value": "98304:EajRZA0Z9v7MfyuPtK1C653DKJn7TVMwsCMe0zK:EajR/QquFKo+DM7TVMYMJzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628598169, "uuid": "24caf586-835a-4898-9c66-3f1520179a23", "value": 3259143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628598169, "uuid": "ffd8e07a-c8a1-4abd-a144-f7440f9d6e8f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628598169, "uuid": "990d2b3a-3802-4a7c-a57c-57424028672c", "value": "74386_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e028f8-f9d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1628597566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597566, "uuid": "9727eea8-76de-46bc-885c-4d1673954ed9", "comment": "Malware payload (OskiStealer)", "value": "245a3d0c4230cbb9b04c98459eec2cec", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597566, "uuid": "60083067-cf1f-44c6-bc04-6b7f23f80d61", "comment": "Malware payload (OskiStealer)", "value": "e38286df473bf02a6fad93aa93a5fbd283faca53a5b52157955cce229a1dc1a0", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597566, "uuid": "fdec4672-3fc3-4619-a158-33c0a644c00e", "comment": "Malware payload (OskiStealer)", "value": "1653f9135d6a2931942a24d1dc9773aabe1591e6", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597566, "uuid": "260e5944-fb38-4fe5-8112-c96b6ce5d1e1", "comment": "Malware payload (OskiStealer)", "value": "7e73120e7152db7ca1cc8cd94b285f741c2c31018b7570fd737a1657bbdfa5e22384dacfc3d395cbccce04873f8958b1", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597566, "uuid": "fd39eb86-74c6-4bdd-9fb8-58c177d54a50", "value": "T14E25010733805763C459AB3B5C99A3A24279EED5CBA1E99D388A393E0FF7B418D01753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597566, "uuid": "45249c31-9603-4ad7-b39a-6a7d4f9416bc", "value": "12288:Oplvxon3qGaNHEyC9/oR9gy5ZHK7z1S6TNCTm9H1tVwH9gd0pod3zBts7Vl+YJtm:fPp9AR95SbTIg1Bd4od0+YzR0xz6KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628597566, "uuid": "4009dd88-ca23-4ad1-b22a-190fb49684c8", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628597566, "uuid": "56055d2d-b27f-478d-aa4a-a93c971f89e8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597566, "uuid": "66e99165-11c0-4c38-8c9a-00a523413754", "value": "New Order_78947533.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9d0b4b-f9e3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628603916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603916, "uuid": "c8caed90-13bb-42bb-9720-fd40f4d2b0af", "comment": "Malware payload (RemcosRAT)", "value": "4bbf2d108f7e10872a657f7395a09eeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603916, "uuid": "09e1e314-b883-478e-ad4b-3277147a5581", "comment": "Malware payload (RemcosRAT)", "value": "e391c863171dbe0a79e9ee01b3f221603e1dddb3938c3215980cd5b991578f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603916, "uuid": "8aaa6e10-0761-4718-9f65-13633413b96f", "comment": "Malware payload (RemcosRAT)", "value": "d895820ac1631c9de8b6561aa9cf39099fb2407a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603916, "uuid": "6bac378f-f80c-48e1-96ad-8aa81682543b", "comment": "Malware payload (RemcosRAT)", "value": "e77658e0cbc808882500ef66c09fc2ff1cafccad84cd704cf15e9be9614af8d592d8c9ea3b10b33ae0dd68106b336c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603916, "uuid": "4f3ffa1b-e575-4d2e-acc1-47fc2fa5a480", "value": "T11F35124723809393C415AB3A109A63974670EED4DBA2EEE9BC41763E1DF6741CE427A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603916, "uuid": "4985ae7b-1a0f-4f01-ba1e-1202030a0284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603916, "uuid": "5aeef825-a3c6-4518-a272-94d474fa6a37", "value": "24576:Y3KpPp9AR95ykxiTXesSdJwjG1XaD1dv2delN/KHoaHEnj/a0hR:7PpKRykw8dCjEAdv2Y+e/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603916, "uuid": "ae711f89-71fe-40a5-a207-c25437bf120a", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603916, "uuid": "9dedb00f-f89c-4b1e-8966-d1b9284d43ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603916, "uuid": "6d588444-3455-4c89-a0b8-81c3add3ab80", "value": "4bbf2d108f7e10872a657f7395a09eeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9dcaf5-f9fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628614548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614548, "uuid": "2f569a17-8ce6-4ccd-8759-e5f9bd02be31", "comment": "Malware payload (Mirai)", "value": "59c90cbbb6f0c00e4888b89f82b1a8be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614548, "uuid": "855ef45d-6996-4d63-a0b7-eb145ddca0b9", "comment": "Malware payload (Mirai)", "value": "e3de29ce4a99b5f76ed4bc240f6b60d58e65e0c7fd6a3d8dc4dfca19950c6df3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614548, "uuid": "dd74cbda-930a-4417-9268-91735d5aebcc", "comment": "Malware payload (Mirai)", "value": "d85f73a5362d0c26f4a38ea5c8d5ab181fe5d278", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628614548, "uuid": "b58fde7c-f66a-4978-896f-ec23d1f5ff1e", "comment": "Malware payload (Mirai)", "value": "0e6e8b38e8c0361618503556ab22c810cde8eadd0b1eb4a906e9dcc16ee7dcc3ab20c0f391338094fbc48eb039856554", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614548, "uuid": "8f284100-2a43-4058-9896-0015f67371f1", "value": "T19A03F20C57E1EC14C9A180F91B2E09603BDE5D0BAE75A36FDC871F6E68D99281528C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614548, "uuid": "bd13efa4-48cd-41e0-87ff-a939ff1d560f", "value": "768:FpcbSG/UWlDKMxJKnIy3iy/oxb1XHOytbH6+yXAzQIeCKZFNzIx+w/ao92:FpESGtKC3dy/oxpXu+jDyIeCmLzIx+oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628614548, "uuid": "0b94ebd9-3897-4511-bc84-2702f0b2d9ca", "value": 39784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628614548, "uuid": "57f3cd06-0932-45c9-b9e5-5e35a9695ccd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628614548, "uuid": "bf1d7593-144f-44d7-8fc1-fb1d63a05464", "value": "59c90cbbb6f0c00e4888b89f82b1a8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c9c160-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1628581165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581165, "uuid": "fb9c1012-a4cc-486f-91a6-46e1c1eea02f", "comment": "Malware payload (CryptBot)", "value": "cbbfe74029e6eb81ccc66d728428b328", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581165, "uuid": "bfce1342-fd07-4608-84d4-9ee0a26fcd92", "comment": "Malware payload (CryptBot)", "value": "e40c1359fa0e86c65f50363b88e29a7d4d24990195cc766273203c496393ebe4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581165, "uuid": "3d6105a9-72b1-4724-afff-1920749c29bf", "comment": "Malware payload (CryptBot)", "value": "75ca75a839b5605286385329839d01986b11b19d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581165, "uuid": "6834ca8a-47a6-4716-b1e5-8d79a6af9aa6", "comment": "Malware payload (CryptBot)", "value": "02a0472d8595844df43d673af7ec5100058b45acc90e08d965cff3cfa93e440b30af98466cd750cad76592fbc8eb61ee", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581165, "uuid": "41d6b6d4-c970-4eee-bafc-e9fdcd7c050b", "value": "T12BD402303640FA32E297453078AD8A64F7E5B9546B21810767493F6FBE733A0276B376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581165, "uuid": "3a3f957f-64dc-48d6-b11c-3d9280631dfa", "value": "97856e36aca27ff13ae687d21f9f6f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581165, "uuid": "26a76f56-3b0c-49f8-85a9-6e17d82a21d9", "value": "12288:bGTJt5et/HePSr9fg/YiTRtILP8IQXbcZ9uDWUJLypTJ4JLvC5:mJfet/He6r9fUHmPpQAWSqkWLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581165, "uuid": "c7d91099-3c61-4599-a79e-c75c817ca4f8", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581165, "uuid": "0d717293-5d70-45f9-9af9-b0074f8d5b06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581165, "uuid": "de461920-bb9d-44f7-bfce-edcfc5636805", "value": "cbbfe74029e6eb81ccc66d728428b328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d850daa8-fa08-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628620146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620146, "uuid": "7bb3bb01-778e-4aac-9f1b-6830b8b649eb", "comment": "Malware payload", "value": "39184e0c52ee804e0c0fa988193e0c1f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620146, "uuid": "f3e16ab3-480b-4bfd-9484-cc62db3c736f", "comment": "Malware payload", "value": "e5058aa3e87cc6bb71fdcb959554e14f5354da24b23350296e406d3f1559a1c3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620146, "uuid": "4adf4fba-f92a-43a9-b47c-13b58b475b18", "comment": "Malware payload", "value": "c91dca0e425ab7a1e85d14ed54033a1a094308f5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628620146, "uuid": "2eff54e2-7e3c-441d-a3a0-b32c0e2aedbf", "comment": "Malware payload", "value": "caac6f60b5f72d4e6c9b3c661660fdec74b44b4eecc1dc600e58d32519518163c694226c3eb0f69bcbe41ea6b70b135c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620146, "uuid": "dfb78795-f165-4936-8e92-c58b59853950", "value": "T130C3F1CB27B16175D5DF6930A6E53322A6F7D78402B35323B61063169C5BABC4F28E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620146, "uuid": "bfaa42d3-6c52-4995-b8df-576cdd324fe5", "value": "3072:aEo0zISHXD0zMegVtqYLlCVhfLb0Dcdg9xxAhsghsH010K0f:afeISHXDEJgXPLIhfLADcS9xxArq010h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628620146, "uuid": "027405f4-04a1-4c2b-acdd-b1ab5c63ae68", "value": 121967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628620146, "uuid": "baf67bff-d3a4-43fa-af0b-13c523ec0208", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628620146, "uuid": "65a858c7-7d81-4f9f-9c34-7655d58605e8", "value": "Android_Guncelleme_build.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7185616c-f9ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628608806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608806, "uuid": "3c4fb289-7c7b-41d8-8c88-ca3c47f10b0e", "comment": "Malware payload (Formbook)", "value": "fe740e7999ea046c611b6af048228301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608806, "uuid": "bda6cc55-bcc4-46ce-8a4a-a5586fd06b4e", "comment": "Malware payload (Formbook)", "value": "e53afd0b5fd432a725fce3ee514f9bf7e58b54b06c096640c0672faf7eb209b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608806, "uuid": "ce534e7c-1163-4a79-adec-09b95efbf36b", "comment": "Malware payload (Formbook)", "value": "b11b855d1328255503fd2e3d86260293af0fef8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628608806, "uuid": "d27f33b2-5fbe-41e8-8f3e-ecca018b3695", "comment": "Malware payload (Formbook)", "value": "c55bb2dcdc21a5f9bc1d6c8830daf25dac640d8c8bc1d2e403f6e30fe019882dceee0fb2b6fb26ed5b3fca85d21e807e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608806, "uuid": "aaa53aaa-c298-4dcc-9e68-7aaf944c98cf", "value": "T19A05E0267741FB8EC17A4EB5C4815900CBF0D6779307F3C76DE209DD5A8E78A8A23296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608806, "uuid": "cfbe8b3d-9df6-46bc-91ec-1e8fc71889b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608806, "uuid": "7c37609a-f309-4fd1-9f20-a8c9373d69bf", "value": "24576:AAsnEguXVgHgteHLHyLWf6A1Ti2KIzoGsrq34MeWjc:3tFWfV4MeWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628608806, "uuid": "559b0810-7878-459f-ac4c-413716933b6e", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628608806, "uuid": "39582522-1bfd-4770-863f-56d3ddcd485c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628608806, "uuid": "ec8c3cb0-ae46-468c-a4f7-93cf92a0ed02", "value": "order9754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5b6785-fa06-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628619077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619077, "uuid": "45971ec7-78d3-4565-b83e-b49259c2e397", "comment": "Malware payload", "value": "da1a3f86b08f03c563a95a386aadac8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMware Inc.", "colour": "#3DDC9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619077, "uuid": "54090850-4cb1-40a2-9ed0-dd0a9bcd242e", "comment": "Malware payload", "value": "e5ad716d23f9cc98a4527bd1bdc9abc9cbdca55626891e2e1d2493c6cfa2f0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMware Inc.", "colour": "#3DDC9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619077, "uuid": "706dbcd8-b4e5-4d66-b38f-79929b54b05b", "comment": "Malware payload", "value": "d78c2351b70a5fee43baaf1ed5869bbf74840209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMware Inc.", "colour": "#3DDC9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628619077, "uuid": "dbef2f21-b0e4-47a5-8432-dd3520c382ca", "comment": "Malware payload", "value": "7aef4a7de1152c9c811e80c36d256fa5b7b4e3520782ab0112de4d6d1fddc694eed837928682ecfb8c7fb26d46358d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SigFlip", "colour": "#FFFA66", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMware Inc.", "colour": "#3DDC9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619077, "uuid": "ca37dfae-9d36-4b25-909f-eda994baac5c", "value": "T19FE57BB07ED2962BD21921B0DA7ED66A516B6D70072416C3E7C94D2938F80F3CF3D91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619077, "uuid": "79a29f3a-4e3d-48e3-b889-5ceb85f50549", "value": "eb365a331a1417ccb3bf5eb1fa07edaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619077, "uuid": "01d0fc6c-5708-471c-bd73-5b9b491e09b2", "value": "49152:7Gl2ZniKEChSEGUHxTXgXwccBwxjBvAly1y88eSxs4HcoMq+B0m:il2ZidCAkHxsTvSNHcom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628619077, "uuid": "b377efa7-3137-447b-b1a4-78a497c57ba0", "value": 3258512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628619077, "uuid": "606190dc-b86b-4426-9299-0c6032b28d6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628619077, "uuid": "98c79cf2-df3a-40ea-a74c-d8bfe08e35e6", "value": "e5ad716d23f9cc98a4527bd1bdc9abc9cbdca55626891e2e1d2493c6cfa2f0ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec4250d-f9c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628593044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593044, "uuid": "925f2334-0361-4c28-a6a4-a0d7a7c2d163", "comment": "Malware payload (RedLineStealer)", "value": "7914f8165ade3f483e1f62dce8ec8828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593044, "uuid": "ef48ed86-4f08-4c66-b926-cbe067568fa5", "comment": "Malware payload (RedLineStealer)", "value": "e5b091808b73fbf1b94a24bb98d8ac945012ec6b69f0979371af225ecdb804df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593044, "uuid": "280a7ef8-bcf7-445e-949e-1578993a012a", "comment": "Malware payload (RedLineStealer)", "value": "7ac59abb131d0644d0f0aa31cb99cf0a415deb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628593044, "uuid": "6fb23cf0-15ec-4b9b-80b5-322cdd2b5759", "comment": "Malware payload (RedLineStealer)", "value": "bb21729f3a88b4e6289f423c31493dac775d7c59c3bd28ea3f099b1b22ad1e20685dfa6137524859c50ddc014a081933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593044, "uuid": "88481df2-95b2-49fb-82ef-f8151a5fb534", "value": "T1E1941205EB68E652C6D48E3BD0D2D0321371EEC66151D70BBCCF2B22A5437E2D94A7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593044, "uuid": "a7967ad4-9354-44ce-99c9-515b246bd20f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593044, "uuid": "db97b461-f162-436d-b126-d0c5f5fb2cbe", "value": "12288:H3TEEK9tNeYHL+niDbM1rEObk+J9l9tUA:H4LtNeYHLEGbMxxk+rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628593044, "uuid": "d11dd721-eda3-4bbf-9d8e-4f5ac71706b2", "value": 409768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628593044, "uuid": "340d702a-e08d-4a50-95cd-94cf5fc7ff89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628593044, "uuid": "5e28fe94-cc4b-47c9-912a-49d2ca9e3a58", "value": "onetap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c6f9d2-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628603636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603636, "uuid": "687adfa0-1b4f-4a0b-b5e5-1a1dd86ee5c4", "comment": "Malware payload (Formbook)", "value": "88aa97175c6d55223e65e743be166f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603636, "uuid": "c0881d1f-385c-4d00-b314-7c6670417e1a", "comment": "Malware payload (Formbook)", "value": "e5ffe75fc564d7a8aaabd188868910ddfc90cf64862f1af80a56c306e9b2e762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603636, "uuid": "1f281dff-4e70-4f2c-a1fe-8fa84c9f70af", "comment": "Malware payload (Formbook)", "value": "2923d1eacbdec6d2a3e92d096a40f6d59f290c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603636, "uuid": "d70ef89b-2f00-4909-8df7-0f501a01a0b2", "comment": "Malware payload (Formbook)", "value": "a747ad301ddaa9f824b87b535e38b86532e43c4072ebcfd290c1bb5ab7bf414357561f04553e6e5dd50dc3eeb612752c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603636, "uuid": "ad7c7ab8-4761-4886-ad06-912de6615fc8", "value": "T15AF401237AC8AF21E87D1B3749E4609113FEFE02DB22C46E6DD534AD4EA7B909161713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603636, "uuid": "218d1c4c-1e98-4ef7-82c4-58979917a286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603636, "uuid": "58e3ca0f-4ed0-472a-9f4d-e5eaf4f840c7", "value": "12288:OpmCnM2iNeHK7z+enElA8Jw8WBUm6eKJ3aMDD9/NKxR6hN4Yi6nP5sWZC1mwlLL:L4M1bCFhwEN5DNNKj6I+EllL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603636, "uuid": "734235e8-85a4-442c-ac75-72d8dfb92053", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603636, "uuid": "48e04590-e637-4957-8a77-10d586305864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603636, "uuid": "cb2f11e8-1555-4085-814c-bd9d0ab381d2", "value": "Shipping Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a146ef1a-f9d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628597719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597719, "uuid": "1335465c-a7e0-4949-8c60-1fec918e3c05", "comment": "Malware payload (SnakeKeylogger)", "value": "519f9833658acf4cbfc0139b990f1411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597719, "uuid": "6004c915-0c7a-4365-8625-b1153c329b2d", "comment": "Malware payload (SnakeKeylogger)", "value": "e61a3b81de7fce074598eb722f5d11e2ccd26032eadfc0d7f2170b03e02a2b79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597719, "uuid": "f0dc85e6-8b1d-4f61-9a43-e557a5cc817e", "comment": "Malware payload (SnakeKeylogger)", "value": "0067b543a25625c4ebe64e633fbc4a5fb927045d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628597719, "uuid": "a86adcd0-5057-4618-ba66-41fe02a136e3", "comment": "Malware payload (SnakeKeylogger)", "value": "63a19e231836f3c47e734706c2767979bf088315d13a698e069703ebc59a9783e59a70edab803c88c247145ff7d6e676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597719, "uuid": "425ff0d1-9a0a-45d1-a99e-496e9567fe6c", "value": "T1B4F4024B23905353C015EB7B5499A35306B5EEE9DBA2EED97883353E1CE6301DE02B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597719, "uuid": "2ef310ef-8ee6-4b13-a718-5c1b1c74be6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597719, "uuid": "8d02b10e-fbba-49cf-9322-517d86a31f9d", "value": "12288:HZKKsn3qGaNHEyC9/oR9gy5FHK7zUXbmiE+JKTNAOhPI5l1yt8jKOhTNMxst1bHH:HZKKUPp9AR95yAivxtwlwdgMxGp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628597719, "uuid": "f9779d49-34b0-424f-90f3-09ee4222e951", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628597719, "uuid": "d7ea5645-14de-45ba-85d5-3539328cacb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628597719, "uuid": "cd674837-3d95-44b8-a3ee-cfc2b44d7820", "value": "_RFQ____.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a236bc-f9e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628603476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603476, "uuid": "21d5d0ea-413a-4ea5-9592-e8c036d0b06d", "comment": "Malware payload (AgentTesla)", "value": "cf95ccea14097221f136d20345d645cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603476, "uuid": "b10c85c7-dbab-43f1-b1d0-354ea315ba7d", "comment": "Malware payload (AgentTesla)", "value": "e6e62011de1f2f3dac869e0593fe00fffc0edefbe24c37cf8faadb5c5791fd55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603476, "uuid": "0b4d76fc-998e-491a-b80f-bb5e2376d139", "comment": "Malware payload (AgentTesla)", "value": "df08ad0f72370f7627b31679c8a6f2bfeaa7c0de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603476, "uuid": "2d16f182-b923-41bd-8ac4-43ea11a384c2", "comment": "Malware payload (AgentTesla)", "value": "82b10bcecd12d26ad59257567cd2f292fe90664bec53f28564f950112cb38a8bce9c0791c9180ede9adbbf466b85e7e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603476, "uuid": "074f4e5c-b5ef-45f4-9e97-35ab16e6a4b0", "value": "T16D05F1263681BB8DC13E4EB5C4850910CBE1E6775703F7CB7DD229EC428E29A4B67762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603476, "uuid": "01b032bf-2663-4879-b4d3-a0b6974cecd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603476, "uuid": "62583951-cb7e-4a0f-b837-3e3cddd2c1c2", "value": "24576:2fzUvVJKNdVkgI+fPDGUVuPedH/d7OKv/6lsq:2SudoK6UTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603476, "uuid": "a6f22db8-4a09-44d5-936d-7ae3cc668657", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603476, "uuid": "7cb28ac7-b475-4257-9484-03b3e31a2e14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603476, "uuid": "a8a28801-883d-4525-8c05-4979f4d2e378", "value": "cf95ccea14097221f136d20345d645cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0af003-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (VegaLocker)", "timestamp": 1628577789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577789, "uuid": "e5a01e42-37d5-41a2-bdaa-3df8583f43f1", "comment": "Malware payload (VegaLocker)", "value": "6a36fca9f379b98c8c762036d066f04b", "object_relation": "md5", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577789, "uuid": "3dddb84c-06e0-4ff6-b2d4-f34d88e750e4", "comment": "Malware payload (VegaLocker)", "value": "e747eb439e6de1810c84d328c6c015365a0b48d87a6e2b12dd9339665ad6af77", "object_relation": "sha256", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577789, "uuid": "c35fafd0-d886-445e-807d-64e6e01cb8b1", "comment": "Malware payload (VegaLocker)", "value": "6bde482cbb536c4b6f6dfce935633eaa8264018f", "object_relation": "sha1", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577789, "uuid": "ca505fb2-920c-495a-a25e-f8185d4e5e87", "comment": "Malware payload (VegaLocker)", "value": "1d2319b7b9c5bfc1c4da622013b3d57b668561c738ce0b5c408b18c40aef896d5c7d48cc97fa0e147835e358736f5a2a", "object_relation": "sha3-384", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577789, "uuid": "5114806d-307e-4678-9427-ecbf2b40a43d", "value": "T13C9423B246E661CB01811B6AA50CE6B06067E65D9C80F35BD4BBAF517F3ED0C44F2B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577789, "uuid": "88a40757-826e-4984-a801-081d8537df73", "value": "6144:rpSdRI6lVv0Gyhyzj6iF70QQ+KtrKTU3tOxil8il4EeHYvwHzxoUZYspqkorbFax:rpcRtlBh2rKo3tcilwDNzxovrbFacFLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577789, "uuid": "778615c6-0b5c-4281-ac99-54aaaea16b14", "value": 437914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577789, "uuid": "5f40d4b2-68c1-4b75-a83a-49e8eec3cb43", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577789, "uuid": "49bc4390-41ce-4fb8-a22a-28d4a41111d5", "value": "2988.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538379fc-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628600595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600595, "uuid": "6eab4bc6-a15e-409c-bf78-acf1c0ebae09", "comment": "Malware payload", "value": "8c33ca0a403e8491f0defd2e5ac68515", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600595, "uuid": "ff803082-f512-4bdb-850b-74faf4149946", "comment": "Malware payload", "value": "e7929b41f6211185990cd523debd50156d6a74433fc04b13cb5cbdf6f25d403a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600595, "uuid": "f2224f39-c74e-4133-803b-e5afc4e70954", "comment": "Malware payload", "value": "9b72f80cbbdb60ec1f787ce9183dd80ec8c3ca72", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600595, "uuid": "795bc588-e3ca-496e-a105-c2c02ab33ef3", "comment": "Malware payload", "value": "6377199873561bb316e4210f7e6b23b770e62b04987d0905d48351ca0bdeac9e67f97ae772274b0b7f206df0a7791cc2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600595, "uuid": "4f94b63a-4a75-4dd4-ad62-e7a739d8ad8e", "value": "T160E56C23B184627ED06B1A36496FA654A93F7A603A268C1F2BE41D4C8F355807F3F747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600595, "uuid": "e172b927-9607-4839-aa91-a55d2595d9dc", "value": "49152:cCt9PxjyXSOSUuHzFpd0TfquXNyqTjYtgf69HOYPFA:75x5Hbd0LXpYt7OYNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600595, "uuid": "ebe06724-5ab9-47d4-b286-91793d2a6e33", "value": 3214848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600595, "uuid": "5c240dec-dd9d-4e86-b40d-a2bc7db60c56", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600595, "uuid": "4d1d3705-fb4a-4581-b7b4-67f3215dce37", "value": "Atendimento 3982773867455.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579c116b-f9a8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628578698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578698, "uuid": "6ca82f1f-768b-41ea-bace-8adca47fb188", "comment": "Malware payload (AgentTesla)", "value": "9b4fdab15f8f50c726778a4597a53827", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578698, "uuid": "e8567c69-754b-47f3-9581-ac46e72906ef", "comment": "Malware payload (AgentTesla)", "value": "e7f8dab841bfbab8c503c254af106b7feba6532147b41fdd7443df082db40c21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578698, "uuid": "5c895110-3c80-4c64-b8fb-244bfb78072e", "comment": "Malware payload (AgentTesla)", "value": "529e05f592f50a2d48263763359751999545c472", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628578698, "uuid": "acb1f284-f544-40b4-9e56-21dffde77727", "comment": "Malware payload (AgentTesla)", "value": "70e565d3e421396866eaa7e3a2523dac1d8ad0aefd92d51e0297bb02afc799264128f53e4ebbec84c9f3626ea25714c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578698, "uuid": "6c151660-b79a-4e0a-af04-71f7a37fcb6f", "value": "T176455B54AF5CAB8BC0160AF2BC62D600D3A5EF1557B2DAC7FA6531C819322FD12729C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578698, "uuid": "e652f26f-eb8e-4c38-b54d-f26798049774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578698, "uuid": "6da4c618-0d80-4057-ba73-132a680b39a6", "value": "24576:qfp2oeWjgaHiCDUB/4YYA7ekHRv3htObbZFLLD:u2uLiay/4YYAFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628578698, "uuid": "39319b57-fe34-428e-9b06-394b88ba4f3d", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628578698, "uuid": "9f8286de-6118-4e33-be88-53b5e22e76ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628578698, "uuid": "8f4e09dd-4ea3-47af-94db-8dcaa75551ba", "value": "Purchase Order296174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983b08e7-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628574511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574511, "uuid": "b7fe79bf-779e-44db-9ba2-83766dbc2b09", "comment": "Malware payload (RemcosRAT)", "value": "71f387101239dfa10204a0b2d7541910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574511, "uuid": "5f731906-17e8-4541-9d83-3c00357deea8", "comment": "Malware payload (RemcosRAT)", "value": "e8b670a416ea518bd6073c440615b624fc91b70cf55e8b63bd524924c37b2970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574511, "uuid": "4112d968-ea41-4953-a554-151a6b3c9f13", "comment": "Malware payload (RemcosRAT)", "value": "3f89b631974b2f2e306f56603230126a3c580055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574511, "uuid": "28646d7f-873a-4744-a338-4976e5148b27", "comment": "Malware payload (RemcosRAT)", "value": "b7c77fe45db3c009152fe835a606733cf69d8563a23df05e29c836c8c604ac4ba77a31dcf3d6edf904da50e655563c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574511, "uuid": "1e8767fe-049e-4a3f-a332-33d47c0c2273", "value": "T135E46D56A2B09F32C33B1638CD8B43D9A55BBE243D1C6BC6BEEA0D1C7F291913624457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574511, "uuid": "2d241eb1-0c00-498f-a2c6-4f10a7d898cd", "value": "64b99ed56fe51c14a44881c90ac9ff50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574511, "uuid": "e79cdd9b-503c-449a-b487-22ae86235837", "value": "12288:SnE1eDMrSuUFA+/ARNb43cRuM7bUwYgsI4pR8/CH3eVgNm+7p:42HfUG+oRNb43chyXI4pR0U3eC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574511, "uuid": "294ca3a3-7b2b-4024-ab04-958e784afafe", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574511, "uuid": "075263f2-fe93-47ba-8765-2d95f6799ee9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574511, "uuid": "f2ee4eb7-65f8-4b6f-ac81-a4183b954ff8", "value": "Confirmaci\u00f3n de pedido nuevo-5309,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b29609f-f994-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628570141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570141, "uuid": "b0f283d9-0002-46c7-b986-5d170be215b2", "comment": "Malware payload (Loki)", "value": "029eb98299179f49091147d34fad1ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570141, "uuid": "f56abfd5-b27e-43ae-bcf5-da8e9e00fe99", "comment": "Malware payload (Loki)", "value": "e9e3490df4628c80e10723892c75cd036d340e4a09ca9527c5710e1b01e3847a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570141, "uuid": "10c589b4-78d0-49ce-a622-8b1a69f19984", "comment": "Malware payload (Loki)", "value": "4284cc0cf7029dc27558ee8c61f7e49248db67ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570141, "uuid": "2e572cee-2f03-4a92-9651-52e36da8d7b0", "comment": "Malware payload (Loki)", "value": "bde7ac23de586cdabae9d75972a1ba5e50bbb18d39a79b618842b5ffb006213e77f77ab927cd55e3ce93c7204bd6fb3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570141, "uuid": "0bc80a00-a77c-4df3-b7eb-c8f54e2f9f92", "value": "T1BF340180E12CAEADC88D04B5A4254C46CA13E9664BF675CF3686FD47BC738C1157AD8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570141, "uuid": "7708f603-afa3-4a49-8292-9a80b3101db6", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570141, "uuid": "3084e99d-bc26-43b4-bc80-28d6593397b8", "value": "6144:+5DLv1td3qE1FZon9Xvt6Qt/5o6WP56vw6d:cv1qWfo9XvMQrCr6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628570141, "uuid": "3496ed48-fa31-48e7-a60f-c49f68ddcee3", "value": 249516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628570141, "uuid": "691d8e99-3b6e-401f-be3d-521ca96061ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570141, "uuid": "e493a471-f247-47b5-982b-448c45a868d5", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888ea2e0-f9c2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628589947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589947, "uuid": "b3ff039b-a6f5-4989-85b4-25c7a60e1230", "comment": "Malware payload (Loki)", "value": "68876b3356b1be74584c39e154e5abcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589947, "uuid": "a5dc6305-c953-4ac0-9b6d-c8766e1aac9a", "comment": "Malware payload (Loki)", "value": "e9efdd49a48ce3a9c8f4bf0bdb38a76b5cef412518e783247c07d11a4e3dabf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589947, "uuid": "a652ab79-613d-46ad-a3c2-bd6810b00e6a", "comment": "Malware payload (Loki)", "value": "7ce3fb557d68864c7c7457c3f088914015358fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628589947, "uuid": "8caeb930-92f9-4621-9c81-91b132b8b765", "comment": "Malware payload (Loki)", "value": "d22817d630e3d8e3e4653654354b50538b2e6082980def2587c5db563f9eaaf9a82be5378d19db6807027564d56d2196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589947, "uuid": "31334fe4-1b71-4ac7-adb0-b2d048dca5cf", "value": "T1E4A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589947, "uuid": "02f8a2d5-dfab-4223-9784-e531e8e90448", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589947, "uuid": "d51255e5-0fb7-4053-b440-c8bf5dbb4dc2", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628589947, "uuid": "83a8ff37-1c7e-442d-9e24-5fb9b214f9e9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628589947, "uuid": "e1393230-cf75-46a5-b889-f0b7c93be553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628589947, "uuid": "db8a8535-9980-40ea-b656-8eafdbef6037", "value": "68876b3356b1be74584c39e154e5abcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e84715-f994-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628570157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570157, "uuid": "5557fd7e-9e20-4054-b83f-c0d9c756c2b7", "comment": "Malware payload (NanoCore)", "value": "9cc283969b75e69c196e8661fea9f7ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570157, "uuid": "616cff6e-6ced-4fdd-9746-ab4cf503a7cd", "comment": "Malware payload (NanoCore)", "value": "ea81656cd2733c5ad12faeb039158012ce49b713f6f0df268a59cec746d0e59c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570157, "uuid": "cf64a2d1-9251-4d50-81c9-6cb3581a4e64", "comment": "Malware payload (NanoCore)", "value": "6d1969528ba831073f32ac98505640aee094b0c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628570157, "uuid": "38e8e27f-9c0d-4648-a48a-7f27fec9e206", "comment": "Malware payload (NanoCore)", "value": "fed1029720c93e3a64f28e5d43ba1fc558c970c1abedfe2e05a941c0d8fe879ddcb826299525d982db2c8594da395fa7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570157, "uuid": "60e4bd25-862e-4e06-86c4-ad40a63e867c", "value": "T17F055A9C326075DFC85BCD76CAA82C64AA2064B6930BD303A05716ADDE0DADBDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570157, "uuid": "25dacab0-ae2d-4b6a-888f-c5f99b27e1e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570157, "uuid": "cd343a44-c87d-4482-8ec3-7ba89c36c291", "value": "12288:S8yQphtg8oZBKeQsAdUdxmcTS/q56WJRklGs3rGKibsUtzl/hqCfgGMLFV2hkVVG:SNwtazQsQUZTS/qwWJVs36pbsExs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628570157, "uuid": "848b02e2-6607-4daf-b192-399fb32eee72", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628570157, "uuid": "335081ae-3f8e-41c5-a3d8-5a07faf9448c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628570157, "uuid": "2664bf69-ddd7-480a-be82-1bd98084f8e9", "value": "9cc283969b75e69c196e8661fea9f7ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3775d53e-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628581221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581221, "uuid": "da8aca5b-91ed-45bd-b324-116666138091", "comment": "Malware payload (RedLineStealer)", "value": "b72a29ce0a458569568d3740452dda3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581221, "uuid": "eaecfef9-9ee0-4541-9b39-b84c97bd246d", "comment": "Malware payload (RedLineStealer)", "value": "ea9decc8f9ee3cb178f1536382263d969a0e3bcbefe3103cf3c901c11344fc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581221, "uuid": "522ec1a5-7a6f-45a1-aeb1-4003ad198d12", "comment": "Malware payload (RedLineStealer)", "value": "207c586b0fe37addb0ad3706bb500470bee0608b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581221, "uuid": "3a7f47ef-6720-4b23-96a0-03ceaace3969", "comment": "Malware payload (RedLineStealer)", "value": "1ae86891dcd058abdbe0387a8b4d8499392d350eee205a6dcba30aa2e73a0b61d78564b0861cac9c9481b13e689c6b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581221, "uuid": "8c10e317-fec0-4f49-aafb-41f32045f5bc", "value": "T1CFD402B17680F531E4A30530745E86A9FBB6BC10AB60424732497E6F5D337E12B793AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581221, "uuid": "e5d240d1-d4f4-406c-859d-842457ca544e", "value": "97856e36aca27ff13ae687d21f9f6f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581221, "uuid": "0af56ea2-184c-47fb-a73d-c1bc9c02edf8", "value": "12288:dt2SjstJEy9ftjsD12ooCdFfkQqU7zAfDtYsD/pN7C5s:dt2kKJH9flsDRoCbkZfJY8L7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581221, "uuid": "550acd2f-9987-4f12-80d7-e89ad7063407", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581221, "uuid": "ce25dc93-d02e-444a-8e19-89ca6bdcb527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581221, "uuid": "b4b43434-c58e-40d4-a14b-7f85187fb639", "value": "b72a29ce0a458569568d3740452dda3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973db520-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (VegaLocker)", "timestamp": 1628577946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577946, "uuid": "36473df2-931f-4466-801c-8b8f8a30a255", "comment": "Malware payload (VegaLocker)", "value": "a37bf6b23f3649d890042536da47d1ee", "object_relation": "md5", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577946, "uuid": "0d70239c-7cb4-4ca4-a70f-fa6af72433f8", "comment": "Malware payload (VegaLocker)", "value": "ead4186dfb2413cbf6153b769c441f86c51802ee90d0112f01ea9fe2b54fa417", "object_relation": "sha256", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577946, "uuid": "7f38a244-5e3a-49f8-bc9b-c835244adadb", "comment": "Malware payload (VegaLocker)", "value": "ee621e173430cbcb707cba8d64fed4e296ef8471", "object_relation": "sha1", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577946, "uuid": "b7c9c539-a802-4f45-a37f-b3077914d5c8", "comment": "Malware payload (VegaLocker)", "value": "7f9098ec7d294e59c03a7fe3636b93598bfbb9ae19716981a51f9d37803b940c4287bc62b5817c492ba11c34d133e605", "object_relation": "sha3-384", "Tag": [ { "name": "VegaLocker", "colour": "#B1434D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577946, "uuid": "7a50789b-eeac-4957-bf26-0bf1fbab2075", "value": "T128C423A42522DE24CFA1F2A467F93DE53D4431CF327CAD97B8F5A8CA12533539987248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577946, "uuid": "539819f2-0bf0-424c-adb7-4da6384bc48d", "value": "12288:yTnwwbKTZF3MdD89g/eBEEov7bHgW2pREO7dC6VtnWn5A:yDwwbKT/ED8a/eir7bHgFndnVRWny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577946, "uuid": "22602f5b-1a1d-4f9a-9c72-7d0032cdec76", "value": 577754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577946, "uuid": "02ad7b2c-690a-4e2b-99ee-f14ba43e0339", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577946, "uuid": "f666a4a9-a610-45db-ad2b-64d55fc4f5fb", "value": "7114.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3f1453-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628600721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600721, "uuid": "9fa88cf2-9a55-4d4d-9f88-10700096e9f5", "comment": "Malware payload (SnakeKeylogger)", "value": "a7f29e6a97b3f6badd27d5037f5f182b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600721, "uuid": "1e957c69-c733-43dd-96c1-0db2d24662c5", "comment": "Malware payload (SnakeKeylogger)", "value": "eadab7cfc026a3c9ae71837b247262b76824f3c82643635184850426b12fc96b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600721, "uuid": "3bc3a229-6c5d-424c-87b2-49c53ebfc068", "comment": "Malware payload (SnakeKeylogger)", "value": "b8f9f3150568ce59200f583625015fa76028cf71", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600721, "uuid": "2ca843ea-afc6-4c78-9f79-3e9a1e8dba86", "comment": "Malware payload (SnakeKeylogger)", "value": "9f91ecc0c85758c8c1021b8dab998331077f2d1455af83831480545f81b0ea21de325b2139a33fa4cbb7b31b860e1e28", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600721, "uuid": "5072259f-9726-408a-b50a-e48fe3c9f2e7", "value": "T148331E6CD09706A88F8AABB82B1B6F46114CB56EF788D572713C63356BD2D7B401387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600721, "uuid": "116dce18-f2fc-4b2c-a9fa-f6978e4c3f70", "value": "384:ukok60JPxkMH7FvwbyBkjgDS4SKt473gS3VlMvb:uG60JPxkMH7FvIOkjVfgg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600721, "uuid": "87a44e4f-5b49-426b-863d-13d03c7016f0", "value": 54659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600721, "uuid": "b0dafd7e-a841-4f2f-874f-62909ba709f6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600721, "uuid": "fb1edc03-c7b5-45e7-9fc4-d7ae8f8c653c", "value": "order specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2a53d2-f99d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628574062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574062, "uuid": "cfdb700f-db23-46dd-96a0-ce10a8aa40d5", "comment": "Malware payload (NanoCore)", "value": "4a36eccbb48f54d243b7982530cfa61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574062, "uuid": "528a2084-e55c-439f-b1cf-684f3c899ba8", "comment": "Malware payload (NanoCore)", "value": "eb2c54829751a21c9865767bcd7056892a02a66f73bf39c2c07a1eb6e3ea5599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574062, "uuid": "06747a61-cdbf-437f-bc67-3bad60838c02", "comment": "Malware payload (NanoCore)", "value": "fbf72fc16184a18f6a15800daa1e828a514fc392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574062, "uuid": "b81aefe2-f5a5-4ee9-8fd8-f153ca3c2f06", "comment": "Malware payload (NanoCore)", "value": "68d9eaa16bb243ef15647bf07f5f927a3fde8231e7981ce103bd6f662cae802690665c07f46f2d403ac6210982a4c5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574062, "uuid": "0d33db4f-432a-4a3e-8661-2ad0f2ab872e", "value": "T1C915020B23804393C402D737549DA3970674EEE9EBA1EFE97842792E1DE6341DE42B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574062, "uuid": "abb9f018-4510-42a7-a8fa-9230600d2be3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574062, "uuid": "2595cd7b-9713-4f54-91c2-dc49e69557b8", "value": "24576:yJKuPp9AR95yTbUwK/blz88KCw/fLZ1R5:8PpKRyTbUwGlUfF1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574062, "uuid": "57a17c21-a094-4fc5-8543-070bfbe19cb3", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574062, "uuid": "08d3d0a9-c85f-460b-ac40-7de79b8e32ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574062, "uuid": "2f19f0dd-5a1d-4dd7-93d2-41e1c0b33c4f", "value": "dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2a96ce-f9ae-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628581179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581179, "uuid": "0d41f026-9858-43f2-b34a-0859110d4d22", "comment": "Malware payload (DanaBot)", "value": "5d45ee069d44ac917ceb37ae019f730e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581179, "uuid": "e151f0c9-2601-4f10-8ce8-f5f6ea65fda3", "comment": "Malware payload (DanaBot)", "value": "eb82641d23dfe5ead3f670666b63ec63aab0da804851e1340bf88012335e9c20", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581179, "uuid": "de9ebc2b-c548-40ed-8b02-5d9d6d487458", "comment": "Malware payload (DanaBot)", "value": "1a54b8edc56e8fc9f9f9a7d45b9452e3ac55cd1f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581179, "uuid": "3aec623a-a5d5-4b55-9fea-e9e0c3c8cc16", "comment": "Malware payload (DanaBot)", "value": "207389968b1a479dcea8579400742dd666cb6de3afa7782c12a07242341fbc561ad451035e7da6e68a10a03cb45bf69f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581179, "uuid": "5ca465f7-5709-4b45-bc6a-b821f8035575", "value": "T1284533C16ED50A36EDB70A309D3052A79CF5B9AD2431E73663206D4E717210AFE687E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581179, "uuid": "7f588df8-3acf-40e8-8a2d-bac30fd3dcc6", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581179, "uuid": "b0d456b1-33e4-4e18-9ffd-443daa921eab", "value": "24576:zLgv1Zacd2B+RDYEseABQBArW+ynMMHyuMY8HKLfcGC0NWbNn7yJeKbNm5F9XVYk:PE1ZacI+Rxn16WjMMJ6KLfi0Uh0m5FYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581179, "uuid": "6c805599-bf8c-4712-8d3c-8a35d98f3a88", "value": 1232739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581179, "uuid": "4885dcbd-53ad-4525-9f7d-4a8654d8615d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581179, "uuid": "35cbc76b-bd32-4e2d-902d-c9391eda4d04", "value": "5d45ee069d44ac917ceb37ae019f730e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1a7ac3-f9ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628581120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581120, "uuid": "287b74ef-5ac2-49a6-b4ea-683da349fb4a", "comment": "Malware payload (AgentTesla)", "value": "8fe8b9c0fa8ce11116c9763f386d5008", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581120, "uuid": "c85e2d03-4960-4d30-b54a-7871e4025174", "comment": "Malware payload (AgentTesla)", "value": "ebabdbd0c42c74fd8fc99a3b2dde6545ddc59c2348833e7138053b20b4b68dbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581120, "uuid": "d8318c72-e0d7-4f71-927e-5f239296fd98", "comment": "Malware payload (AgentTesla)", "value": "97471614e555105592c8e362e8cafebd6d425853", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581120, "uuid": "bf0106d4-d6ed-4990-a007-4ed61d50cde2", "comment": "Malware payload (AgentTesla)", "value": "0c60c06b852f9ba83f46f7eac0b47ecd8a443af2cc180336f0a51462c71487998430e649e07fa218037c5819d9136424", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581120, "uuid": "18743725-d837-499c-80b4-4aee7534b2ce", "value": "T18FE4D0F5153E771BF49309BE20B191A328A084EACC6DCBE0F73355ABEF1555B6081786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581120, "uuid": "8a1a6eb5-1293-4c43-8c70-60a1895441b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581120, "uuid": "13123403-5dff-409e-b25f-7336047d99a6", "value": "12288:xOsBgo0q4wMI3HDOhr8E+PA4uA2RZrXh8aFcs09JcadEOt1hbio7s:xOsBgo0q4wMiOp+JuLrW/pjdpXbiKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581120, "uuid": "4ce8e653-abf5-4ec8-af1b-0286db174827", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581120, "uuid": "4dc9492a-4204-47ac-a045-491a93a19b34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581120, "uuid": "f8bb4e60-39a0-4ce1-b0e9-5b4b9a830226", "value": "Payment_Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4017c3e7-f9e9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628606576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606576, "uuid": "578c058e-d793-45f5-bf54-14523e19d123", "comment": "Malware payload (Formbook)", "value": "4a18a824aecef26f86a454b0a568ed55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606576, "uuid": "8dac2734-751e-4b9f-bead-8157a7b79462", "comment": "Malware payload (Formbook)", "value": "ebceba62910d7167907d9ece3bdce1dacdf778e82d07801478e0240621100b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606576, "uuid": "a18e5cc4-2f18-4821-a486-1025d16429c9", "comment": "Malware payload (Formbook)", "value": "96b62057be687eef380d5d580003719aa5c6f32d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606576, "uuid": "3419b508-d02d-4e19-89d6-ffd849997ea5", "comment": "Malware payload (Formbook)", "value": "d542ec34de957849a8f5f7ed7dc1fce46d7b1e40799addd7fa7bfe00a0a9c31b9dc74b8b29bed376031b08d3cc54a3c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606576, "uuid": "7395a457-41e8-4e1d-b4fd-eca8e0ba8a9c", "value": "T1FB15024723809393C415AB37189AA3970675E9D8DBA1DEED3882742E1DF7341CE17BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606576, "uuid": "ab1da126-ed9f-401e-a01f-5e010449a2db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606576, "uuid": "50b2e1f3-996b-44d3-b11f-0ddbff1d2025", "value": "12288:uWK3n3qGaNHEyC9/oR9gy5FHK7zMQSGedS0N2hIbUKf8DZAiMKRT1VOeJLz2HVJ0:uWKnPp9AR95yv0dS0wIP8DZAiLT1FU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606576, "uuid": "bf3189de-57c9-47db-83dc-3434a516c573", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606576, "uuid": "67e28e6f-5fe0-47ee-9671-e29fcbaad9e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606576, "uuid": "76a56c67-5bc9-42bb-9c42-c1ef0debd217", "value": "4a18a824aecef26f86a454b0a568ed55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1a158a-f9dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628601232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601232, "uuid": "41843a02-41fd-4bb5-b578-6feedd578d33", "comment": "Malware payload (Loki)", "value": "c54fe7314f53e06a78085550766b2c60", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601232, "uuid": "827622e9-9388-4878-98f6-28799cc65b10", "comment": "Malware payload (Loki)", "value": "ec21049172db833a758683567f8d436246c860a83b2a9592bcda9e6cea70ff65", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601232, "uuid": "af146c2f-13c7-45e9-894f-2ae07506a16b", "comment": "Malware payload (Loki)", "value": "bad724f5be026abc1cd3cce521ff9e4485df4fd2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601232, "uuid": "672ceb65-2286-43a4-9789-81cdb20fca6a", "comment": "Malware payload (Loki)", "value": "fc7d0f376d24cbdbc17bbf3df22fdc16d643e385ac2cbd61e29f7adb5b8cb539d5b46219bc7aba875946ca74c66edf1d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601232, "uuid": "fb3dfb85-d868-4494-a603-1fef37440e7f", "value": "T1FD351222A4F947A2DEC9C1B72D4B8BFC8E65CCDA3D84C93F967436465F7D268D281108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601232, "uuid": "4241e01c-01ed-4a34-9594-5bc97444ae62", "value": "24576:TZQtj2CVf/ROa7MlH/GE2Q/zz6nCe095Zj48iGctG:TZC64HRbQV/GWzJR93j5lck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601232, "uuid": "e7f76e4c-1875-43ab-a6e0-8cf250531e28", "value": 1159992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601232, "uuid": "5a84a1e1-95b7-4272-8a5f-e4f97a3b7f98", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601232, "uuid": "4644a052-6420-4caf-a451-aec2ff9b4c8d", "value": "SHIPMENT DETAIL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c7a89c-f993-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628569642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628569642, "uuid": "9d030d39-eb3c-477b-a96c-ef161f327865", "comment": "Malware payload (RedLineStealer)", "value": "db894f90bd4d25bb9e80f7a4fcd74b76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628569642, "uuid": "98e0d56b-59c2-4bbb-9aa2-6a3b64439e60", "comment": "Malware payload (RedLineStealer)", "value": "ec78fb6ac079e992615f56fc642b56a5ffe5e3c997ed6963fea4ff2d8d74d348", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628569642, "uuid": "3db4feaf-98fd-44e8-a6ab-0bf6b919c36c", "comment": "Malware payload (RedLineStealer)", "value": "2e2e97a2147cc8f6f9d5ca6eebede8729c174883", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628569642, "uuid": "684e98d0-fb50-462b-94a7-cc82495d30b7", "comment": "Malware payload (RedLineStealer)", "value": "cc0d8def34f421101e13e7d298197b5d4e595c17fe899b1fdd86e7b6a0ec4cbf00aa8ff9f80f6e77cf1bb6dc66432a45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628569642, "uuid": "f6b0876c-a44a-4e4e-894c-eaf121d90813", "value": "T16F84362864BFC01981E3EEA12DDCA8FBD99A55E7640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628569642, "uuid": "c0256da6-51e9-42cf-ab2b-5ed3fe998779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628569642, "uuid": "0ba14bc1-7a00-40fd-8d7e-f1c024834c6e", "value": "6144:FGShUfR1Gd4QEaVY3MCRRvQQ/3caG+woEe8:3hsR1Gd4QE2Y3nRRvQQ/3caG+woEe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628569642, "uuid": "c8e88503-a046-4b99-b14f-4b8553502f39", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628569642, "uuid": "3ec4d0d2-67f9-4d98-8aad-e10aa9685673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628569642, "uuid": "1b31460d-1b7a-495e-86eb-775c62e6868e", "value": "db894f90bd4d25bb9e80f7a4fcd74b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adfe2bc-f9fa-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628613922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613922, "uuid": "bdbe62c9-9226-4468-bab7-2bf6a3a96cdd", "comment": "Malware payload", "value": "cb3b8bb92c43db38136fc856928e982a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613922, "uuid": "4ba6e13d-4005-4ee6-9752-7329bf537f27", "comment": "Malware payload", "value": "eca82507af36f745dfa5b2f70c1ba8c41a39a4fa7fa8bb83dd4dfb7ed989af08", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613922, "uuid": "03a2c3e5-d6de-4ad9-885d-8bed8cf1529b", "comment": "Malware payload", "value": "0561150a99f522c2254717197bb15d56ccd46496", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628613922, "uuid": "ddc08067-0fba-45e3-b312-016d4e95ae18", "comment": "Malware payload", "value": "9f058944c32aa0fa9cb3f246a601dfd76989bf518fc9e3c8fcecd26de64074d1b04c642d1776d8529cb38faf24871242", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerber", "colour": "#6E6D4E", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613922, "uuid": "1c532535-573c-41a5-a3b2-8c16be5e3878", "value": "T104D3025B57E004B9E5BBAD310F9DA3232E769890BF95F3C339009008AD6676B2F58F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613922, "uuid": "634ca971-aa95-4227-876b-c302a56a9c27", "value": "3072:EIwAo4L9WYbyOHChIrxwKyL4bm2o0puLuIQ2XzXcvr:73TTiqrxwZL4bmB0povQ2jsvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628613922, "uuid": "2551a499-051c-4be2-b2d9-7ebbf80b17f8", "value": 136624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628613922, "uuid": "3465dcc1-5379-4b3a-93ed-e11e3ba14cca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628613922, "uuid": "4258b1a5-ab75-4998-a0cb-945ffaab132c", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9d5a43-f9af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628581631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581631, "uuid": "22566b73-1362-44d4-884a-fe9fad9edec3", "comment": "Malware payload (AgentTesla)", "value": "98788c9ed494001514d2940f795d021c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581631, "uuid": "e1d9ba46-20c0-49a4-830c-12bab10ae9d7", "comment": "Malware payload (AgentTesla)", "value": "eebeeb4f8ccd21f31c4b85e2657bba916bf0344dbbad48672888d6911388eb40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581631, "uuid": "1263d695-503c-4211-8d95-de1739baa1dd", "comment": "Malware payload (AgentTesla)", "value": "50a0bb6c9e8e683814b86f6a461e861ac76837ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628581631, "uuid": "d052c88d-5a8a-4908-a002-11694f887b5d", "comment": "Malware payload (AgentTesla)", "value": "0f43980e2e3fa293f01e9d67a530879401827a3e817fe499c111b8aa90d3e820d54759ccbe4b627ee8fe5690ac4c3256", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581631, "uuid": "3fccfbac-163b-4183-a827-268ef22d8f8e", "value": "T16622B09CCAAE970DD123A975767D08BF03044C2D7D5ADB4F7CC8370E8B2158A9BCA458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581631, "uuid": "fd5e796f-29a0-45eb-9a98-64f190829b12", "value": "192:xrXP/sg1BoFGS6TfXmkM3sPiJmJcLHFc+JPgHdPaTBT3odKK9yC9QuHXl:dXP3oFYXm9cPio2HFcogHdO5odKQRQu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628581631, "uuid": "b022b10b-97ab-4533-a628-126ad8b2fe96", "value": 10646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628581631, "uuid": "ce031843-6c01-43d4-b9fd-555c7a707816", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628581631, "uuid": "2e3b9bb7-e678-4960-8143-a4a60eaf4a4e", "value": "URGENT DRAWING AND QUOTATION.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d92f2a8-f9d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628599646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599646, "uuid": "711b3bc9-3294-4e00-bfc1-4b571a41d991", "comment": "Malware payload (AgentTesla)", "value": "5e90ae7031401380f4409d5dcdc15ffb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599646, "uuid": "078698c0-3526-4318-a570-1e5106df69c6", "comment": "Malware payload (AgentTesla)", "value": "eed1fb31c80c335d035e9e3635e149edd618e636fd563fa3aaa4ad1cb01d7a1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599646, "uuid": "fdfed574-94fe-459b-819a-12cdfbb41085", "comment": "Malware payload (AgentTesla)", "value": "2e189610ecc96bbe6b805ad8189fdfc6608a5d47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628599646, "uuid": "b3100b52-2194-4486-853e-0e85632f60fe", "comment": "Malware payload (AgentTesla)", "value": "1e36a145f6bdab7bb9de0018f06f19ddffb94f5edf801d8f27294d540e4880f4d478c3768eb6c8bcdb9ee3dc3159c56c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599646, "uuid": "97dcf91a-32d2-40af-b9a7-4e5975dbfbd7", "value": "T16525B545468FC7BFAA5B22F0082C109C94BBDD2EC209BA79BE0E4D76B563FE5113D485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599646, "uuid": "8560907e-b478-4568-afef-6a90f42ee86a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599646, "uuid": "efa42183-8e2b-4e50-89b0-c1e53dfac733", "value": "24576:GOW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hu3Av:4iecKZfm1sTvkiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628599646, "uuid": "699823bf-c5af-4415-b85c-c515f20d0958", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628599646, "uuid": "1835c7f4-4d96-46c1-951b-82404ee30ee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628599646, "uuid": "c7271df2-1336-4c02-8f92-1992c8e30891", "value": "QXVLFYXR3woRpIg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0891ec60-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560526, "uuid": "88ca428e-52e1-4d6d-a41b-fc462d90139e", "comment": "Malware payload (Gafgyt)", "value": "8ad7425d71dfdfd6f5d46c6cafcee015", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560526, "uuid": "275b120d-4472-480c-a76a-d5e628e7e4ca", "comment": "Malware payload (Gafgyt)", "value": "ef339c526ad456780e18f687e1083243ea848778d4a9768c01714e1918a60a6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560526, "uuid": "1cad2948-fe2b-4b6d-9aeb-e460acef26b7", "comment": "Malware payload (Gafgyt)", "value": "2ff807f1e1244604566c014f8607f638ef3037eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560526, "uuid": "1e51ad56-3e87-43e0-87e8-8a78dd43cbdc", "comment": "Malware payload (Gafgyt)", "value": "acf435e55035fb30cd78dd1e4858942d6970ec5244cd2b8ae928855fa301279179edaec0c42b8c74541d64704678e269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560526, "uuid": "d3bbeaf1-3601-47a9-8370-7ef3a70fdbe9", "value": "T101C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560526, "uuid": "a14b8b6c-e29e-4c34-afb3-510d09f302b1", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeREdWfRZrmW+IFj:Ted0W0MZQHNd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560526, "uuid": "6944027f-a31e-444f-a148-c030e3eff852", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560526, "uuid": "3ec8a922-631c-4a81-a558-0c36da934231", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560526, "uuid": "6390a616-81e5-451b-af2d-066f21622eb4", "value": "8ad7425d71dfdfd6f5d46c6cafcee015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f6a8ff-f9b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628583769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583769, "uuid": "f7b35beb-007d-4661-ae10-83b6bef36ff5", "comment": "Malware payload (Mirai)", "value": "7f7872be98f4d78afecb3ed5bc40a33a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583769, "uuid": "63b53956-993c-4849-afa2-c1c1538b750d", "comment": "Malware payload (Mirai)", "value": "ef97cea83487ce762d9716d3cfa87e7709e11d6317ff98d69649bd4487bce215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583769, "uuid": "9c96c648-cab4-4c0e-84c7-611be9635d77", "comment": "Malware payload (Mirai)", "value": "0e19a35f84f16ac24f918ea1d8102eb328079cb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628583769, "uuid": "c1e6e864-99b5-4e27-b55e-0a4247d001ec", "comment": "Malware payload (Mirai)", "value": "b5b7d0f69def410e1ec77d36ee84999f71c1517e5620b58f699bebe6924e67ba167b6ff9d2093f8bf27c56110aad69c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583769, "uuid": "76e76170-59da-49a3-8d35-e21b3a8020c9", "value": "T1C5A3A30D7E219F7CFB98863447B78F21964837CA2AF1D584E15DEA011EB024E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583769, "uuid": "69a1d5af-0eba-4797-b814-a66f923aa953", "value": "3072:BNe0/ZXCGjkFdc5lIWQgpguiFoGuSrqfuiFz6RWQ8W6XCtr2:BNe0X/gjQQ8OoGuDx3/Wr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628583769, "uuid": "a2fe44f7-6539-464d-b18d-3cc10fd0b45c", "value": 101844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628583769, "uuid": "3f44cbd6-060f-44cc-80d7-7fac652fc201", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628583769, "uuid": "7d281d13-9bdc-4bd8-be63-2c00dddc7d39", "value": "7f7872be98f4d78afecb3ed5bc40a33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a81f5d-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628600604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600604, "uuid": "74218ef2-acd1-4d25-ba4c-ffee9de88dc2", "comment": "Malware payload", "value": "ff53e0a75ae7d88064dac7e20d0d5034", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600604, "uuid": "365183f7-b8fa-4740-855c-be7172cc9534", "comment": "Malware payload", "value": "efe1d69eb6925530a15fc55b936d1a5eaa8fd93915d0a5b58758ec807ea7b7de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600604, "uuid": "86268ecd-61e5-4da8-a27f-95020369cedd", "comment": "Malware payload", "value": "995939feb9dfe7e24e0da6a531f2374048519274", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600604, "uuid": "9e0267f4-b719-45b5-a924-217f2fc39cee", "comment": "Malware payload", "value": "44a83784ba53c28bc56d80b8615779f8d20881960d6484837551c440b754b569508d44d52e0e23ba96730e7aca3263ac", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600604, "uuid": "445b216f-d315-49e7-b68a-4adb22efc639", "value": "T105E55B23B284613ED06B1A36496BB6549D3F7A713A168C0F2BE4294C8F355807E3F75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600604, "uuid": "1edce5b1-cf12-4cec-8765-936fd86c2d50", "value": "49152:RCEdKjtR0SOSIu+RFDHLUDq4/rtUTjWtgf69fOYOFA:PAj/+/HLS/8WtbOYUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600604, "uuid": "0796a67b-22ac-4f07-a29b-17433aed9c83", "value": 3219456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600604, "uuid": "ada7ebe2-f6f6-4d83-aba5-0a26d096e395", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600604, "uuid": "44e61e0b-6cd0-4bc6-bf51-33636bddf20a", "value": "Atendimento 29723878237745.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11f738a-f9ce-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628595142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595142, "uuid": "c98d10d5-bc4a-44bf-9b8f-190a935ae4c4", "comment": "Malware payload (Gozi)", "value": "98251d7e16a4b1e7738e758dd1cec790", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595142, "uuid": "4550d4b0-3852-409c-896a-80247724bee1", "comment": "Malware payload (Gozi)", "value": "efe6581132d528611f1673583bb79ea93ff9b67623423d7761d9ab296022d81e", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595142, "uuid": "3323e6a5-69f5-4569-95da-54ace91af8a7", "comment": "Malware payload (Gozi)", "value": "ef103f7219d031f95f3288d43dbb8334c66d2f2c", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628595142, "uuid": "c6033e4d-4360-41a1-8293-5fe4eab7f76d", "comment": "Malware payload (Gozi)", "value": "aa728294c66304aee6cf3adcc72192c39462b8d2832ac552158b9b272f69465fde36991dda66bb2ebe80cb28f609dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595142, "uuid": "b868f4f8-bb03-4257-9234-b407acd6552b", "value": "T174D3FB776611D68BE60B32348F83B9852229EC01BDF5CF333214B36DD87E6604D5AA36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595142, "uuid": "7d48489a-8dfb-48d2-9dce-a1d5e0a8681b", "value": "3072:cwlYkEIuPm3fNRZmbaoFhZhR0cixIHm0p9sdDdCHPtTd:NlYkEIuPm3fNRZmbaoFhZhR0cixIHm0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628595142, "uuid": "31dc0180-000c-4003-a9dc-8298dce09071", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628595142, "uuid": "95558503-1768-40da-ba02-7dde6511eeb8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628595142, "uuid": "310026a9-cc69-479a-90d5-fc0562b4af24", "value": "03712.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05aa69ac-fa05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618504, "uuid": "fcb2fd6f-c2a9-4d8d-8e6f-579dc9608f87", "comment": "Malware payload (Mirai)", "value": "57613de661e282169d63fb6a9d840c1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618504, "uuid": "363481ae-98f4-4d87-a094-0cbfcb4d0f0a", "comment": "Malware payload (Mirai)", "value": "f23c908098395285509f7d3424f80f4bb7c685f44fbe9035a09c3d526813ccaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618504, "uuid": "1572e034-15e5-48d0-87e7-96ca56d84825", "comment": "Malware payload (Mirai)", "value": "22d6ec496fa0eacd39a4e5fe1a5a2411057bfa48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618504, "uuid": "5a40dd8c-582e-45d1-82ca-dfb4bdd74964", "comment": "Malware payload (Mirai)", "value": "149e6992c71781efff085dde51e90d26993944571b10958151615c0c44645ae675b6017101ca1ad61c98ce66df2d2a7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618504, "uuid": "11736f46-de73-4f73-9481-25b7d041c27c", "value": "T148A3E71E6E219FBEF66CC23447B35F20A26933D617E195C4D2ACD9005E6028E645FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618504, "uuid": "0a532fab-71c7-4436-8fa8-a49881cf37f9", "value": "1536:HRSc/BeWlsAdS1IRFrwYyNHyxwwV+4oKq680mlReWM5hvTE+:gc/4AdSyFrjYpwV+XK780mW5hvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618504, "uuid": "31b4db2b-aadc-4d21-aa61-836dace52c19", "value": 105388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618504, "uuid": "00e88727-ec80-4ed8-9cf7-64b7ae10d719", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618504, "uuid": "1c45c29e-b002-4682-8c5c-d666cde26a0c", "value": "57613de661e282169d63fb6a9d840c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0613da-f982-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628562356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628562356, "uuid": "c5c9022b-e162-426e-9266-e6ec214c2346", "comment": "Malware payload (RedLineStealer)", "value": "8d6b135d96ff48d1f3e63472217439bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628562356, "uuid": "4993c8b0-98c8-4da4-bb34-0164a22798f7", "comment": "Malware payload (RedLineStealer)", "value": "f2902d95a0b592aba3ee624dcce02c40b9ab8b8b10c7636a4dcfa628e62354e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628562356, "uuid": "64c14f6d-baa7-466d-a4c8-176663ce6bf1", "comment": "Malware payload (RedLineStealer)", "value": "5ee88a0c00eaaa65c8c6b9dcc854218a0a9d7f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628562356, "uuid": "f2a112fa-f4de-4c8d-b114-934e9b7023ae", "comment": "Malware payload (RedLineStealer)", "value": "a85f9744ba03397705258a61dbb82b0995767c56635c65d153d25741f3050f19a1ef7041da5fee89c03f31a5c4cd6912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628562356, "uuid": "ff595dd4-acbd-4a0d-bca8-09baad5a9d63", "value": "T11035335155EF04DAE52FFDBA607820B7B38DDB9C4721012635E8045AE753AF2A4231FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628562356, "uuid": "7329f513-ce53-4e26-b6da-b0d70c4734e5", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628562356, "uuid": "8ae811fa-b0b6-44b1-8807-42474d6662dc", "value": "24576:IW5eI6QAdtdt9GgAx7/qthIWw35KdOftpL1Y5XQcnK0gj9l:Ioeke7AtKPw3EarGln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628562356, "uuid": "e20e0047-d03d-45e6-9418-5ea8ea70532e", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628562356, "uuid": "570d0fdb-dcc5-4cd5-8b79-2cb5fce57c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628562356, "uuid": "4fb37f69-627a-4917-9fdf-e2e1f832b8f3", "value": "8D6B135D96FF48D1F3E63472217439BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4407bb9-f972-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628555768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555768, "uuid": "ca7e2c60-65be-4bdc-baad-fcca67920199", "comment": "Malware payload", "value": "600c90ff8e78c7f3cae8cdea3358653c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555768, "uuid": "9fdfdabd-81a6-4151-872d-e04bc1fe63d4", "comment": "Malware payload", "value": "f2aa36b9c0d8e70d031461914d8388cc93bff1f73fd98dc4128622ac8800d660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555768, "uuid": "d1134195-9f2f-43bd-9416-dcdb5a78a3b7", "comment": "Malware payload", "value": "4bd7d8488bb617509c673893209c28883e9549bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628555768, "uuid": "194a782f-c64c-4b70-9429-c00cf3d77d63", "comment": "Malware payload", "value": "3d9c9d2ab206ade60b0ff4825ef4eca184a7d3d0edfd432bd0dc5a6d23a11cedd9dcdb49b5be0e4edae416db864af827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555768, "uuid": "9ecb00db-17c9-4523-be6b-cc7a37eb9669", "value": "T10873E1BAB5DD463AD33E5377CC03A2C10235D602E0C289A90ADD6D3DAF372365642B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555768, "uuid": "d474be69-063a-4d20-8064-5265dad378d3", "value": "1536:+v5dEnEr8VWFjV+lYVjaOm+IDOULj6/yEI1wYeRD3d26yKkaPD91zzNpf:+v5CnoMlYVWfOUv4dLg6yK/P1pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628555768, "uuid": "4b0f2134-000b-4263-97bf-9aef05b0cd3b", "value": 77511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628555768, "uuid": "ad3e3493-399e-41b9-a0c3-d5571a15c45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628555768, "uuid": "909045ad-81d5-430a-97f6-47f012f704b4", "value": "Document pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a37a7a9-f9e4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1628604580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604580, "uuid": "92b1f133-1b30-423f-af10-2c4616ac35ee", "comment": "Malware payload (IcedID)", "value": "f75a0e4c7bf4653d308f8cb4789cb402", "object_relation": "md5", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604580, "uuid": "59a08b06-0deb-47b9-ab95-f4b63291b854", "comment": "Malware payload (IcedID)", "value": "f3e6e34b2d96164ff15a44f84667bebd4cddfffb74ad743eb1165dc1d00ea1ce", "object_relation": "sha256", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604580, "uuid": "db3ba7ea-63fb-40b3-a0ca-4d5044673722", "comment": "Malware payload (IcedID)", "value": "d345c645d5e41f1ccaf3de900a588a8b452af55e", "object_relation": "sha1", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628604580, "uuid": "d5bbf5ae-068d-474c-b1f7-1873ee6968b3", "comment": "Malware payload (IcedID)", "value": "751c630567ea7bab24d894125d2392a405499b400e0d923233ec9c3335ebcce08a694e55ccc2c22d3563a69b4a5a876a", "object_relation": "sha3-384", "Tag": [ { "name": "1654790838", "colour": "#54C4D5", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604580, "uuid": "9955795a-fd3b-4942-bda3-9572b6b31b78", "value": "T16EB30264D5C85529C2D6727C2C03B2D09BD3A29DD263CF1E38DD60D6C9436B72F58AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604580, "uuid": "6c8cc5ae-57be-4986-aaa1-3c15e91cdcf1", "value": "3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZ4:PLvB83+cySlVYmLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628604580, "uuid": "ba912cf3-4028-40db-8eef-c089a7ab03a3", "value": 110306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628604580, "uuid": "b7aa7955-c81f-48b0-b4f5-89a4959cef35", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628604580, "uuid": "20a15d8b-c35a-46c8-bd50-d4bc0d0f4927", "value": "doc_main_79.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc0eb28-f97f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628561129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561129, "uuid": "f2bdcc11-7fee-4a04-abd2-b580e7f888e1", "comment": "Malware payload (Gafgyt)", "value": "55ec3d0bb517983558005b5b698a291f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561129, "uuid": "8127b9a5-1dfc-475a-b8ad-88f33e460a43", "comment": "Malware payload (Gafgyt)", "value": "f4b012d650d2d3352e4ef361069b113c543f9db407787cc5a6720c58d1db28f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561129, "uuid": "7815dfbc-49b1-4b28-b6aa-4eaa8b82b92f", "comment": "Malware payload (Gafgyt)", "value": "b4ac8344419c177744554b6fafbca8e2a33d7c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628561129, "uuid": "2b1fc752-9e8a-48a3-8ae0-d9aaf2ca7948", "comment": "Malware payload (Gafgyt)", "value": "3e65badcdaf036c483e95e4d9b8f7f53d63d8035a782c6f07e8a82cc1ba44f7bb94494a6d5fdd7b04716a8220cfca8ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561129, "uuid": "b824496e-1d78-40a3-8f57-4779d1604df9", "value": "T15BB31807B70D0B93C4CB56B03DAB2FF15B68BAE113937181692AEBD017739B52512F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561129, "uuid": "f293d010-0830-4d54-beb9-31fb85244fbd", "value": "3072:xrH0jQEEA4cn73xSYFhqpxEmKYVVDkEMNfR+e:xrH0jkA4cn7h5FhqpxEmKYVVDTMNfR+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628561129, "uuid": "42b67a1f-8231-49b2-b710-735a26a1068d", "value": 114079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628561129, "uuid": "eb6f5a8d-daf2-43ef-9c7d-b5548751ffd6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628561129, "uuid": "a906c100-3dc0-4bc8-a11c-0524b9d0937a", "value": "55ec3d0bb517983558005b5b698a291f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7a0202-f9e9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628606732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606732, "uuid": "6c6d30ba-453a-4106-a96c-e30bd7548732", "comment": "Malware payload (Loki)", "value": "ff3a9b3e49d0dc6b0f91956d44a10b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606732, "uuid": "e4fdb1c7-1f4d-428b-9f51-ab0473c5d27c", "comment": "Malware payload (Loki)", "value": "f513586a6714e75f26ce6068996b786f33711477f413ab918b5a736d6daca9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606732, "uuid": "d5f7864f-b2dc-4ba3-b810-a9a4d288a3b3", "comment": "Malware payload (Loki)", "value": "a309a98a10c9de52cf1d109eed34276220237a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628606732, "uuid": "8ec03db8-7e7b-4733-83bc-5a56ddb51294", "comment": "Malware payload (Loki)", "value": "5f2412d1fc4479bfb9ede5c31b77b9d1337ade62e82673a760891291ff07b63efdbe64ab0dfbebea625a022d5ecf6189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606732, "uuid": "9621a5a2-055a-44ce-899c-ed90b1a9c916", "value": "T13EE4022336948A05C03817F8446BD1457BF6AD09D753E61E7885F6AE8AFFA8CC672313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606732, "uuid": "a34c1841-a603-4378-953f-493ce919b84f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606732, "uuid": "8ec9aadc-2e80-42c2-8dc0-69d3648e69ee", "value": "12288:UtzV7HK7zpxbBzMYQQxq4KwVKaPZN4vAjLR6S+t+Pi+khRO:iz8lrzU62da9P+t+Pi+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628606732, "uuid": "2e6f15b2-2c07-41ff-816d-4cb60e34c485", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628606732, "uuid": "40880393-1c5b-4ea5-9a88-d37eea857b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628606732, "uuid": "c283aec0-489d-4ed8-ac85-1a50ae25a40d", "value": "RFQ08102021-2FCLSHM REE#047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca195b2-f9b6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628584612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584612, "uuid": "c73035f3-f544-4082-9f98-cafa130d54b0", "comment": "Malware payload (RedLineStealer)", "value": "8b7c7964bb85adb81f89ed52f1a9c70e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584612, "uuid": "1a76d5ab-a46a-46a6-b943-f73195800d73", "comment": "Malware payload (RedLineStealer)", "value": "f59a34fc166d2c686db6d135328ff4427a21df51b0a250567c983fc25c19ba0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584612, "uuid": "edcf55af-6810-480a-9105-fc5485ad1635", "comment": "Malware payload (RedLineStealer)", "value": "d1056b79ab5ad378787e2eab8c63592f7c2a3d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584612, "uuid": "61c41002-67dd-4435-a783-59a2dbf0d4ad", "comment": "Malware payload (RedLineStealer)", "value": "2c3d9e97b854eafc59a6fb06d20d29cba70dd06d128c8332c281ffeacc66f01822ee9d5d228401d945a916b249b6af91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584612, "uuid": "839d21e4-2bd0-470d-b1f7-0ea4a8f6b93c", "value": "T15C94598970D72382D963E9BE4B41E49057F5B0176BD4E08218CEE05E6F9B7E0295CB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584612, "uuid": "38198c04-ce35-4801-932f-a8070dc50a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584612, "uuid": "7e3f10ab-dbad-4f5d-85ef-14179b6168a6", "value": "6144:mm9srIvWrdL9HkED4RzpTfCxSW4nO52xSU/SekkiwaoeyltI9DVjUAN:srIerdL96c74O52MIDBxatLVQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628584612, "uuid": "6fb96c55-8e70-4031-9857-31299f4644c0", "value": 410752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628584612, "uuid": "5d89d871-aa4c-4d95-93ae-52a553861841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584612, "uuid": "e78494bb-8521-4e6d-87a7-ac50b3f014fd", "value": "f59a34fc166d2c686db6d135328ff4427a21df51b0a25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d7bc2b-f97c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628559790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628559790, "uuid": "e5b149f6-f752-4daa-8afb-5a7edfce264f", "comment": "Malware payload (SnakeKeylogger)", "value": "53da681895a602bbd5e900fd9a2ebf7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628559790, "uuid": "c61548b8-75e0-4d0c-b3af-b35cdbd3220c", "comment": "Malware payload (SnakeKeylogger)", "value": "f70645686b23dadce3d8bb102a514833b32c8480aad0102ee50420ddfaef4a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628559790, "uuid": "ce6f7aae-733d-44e3-bb01-9fe22edd90ef", "comment": "Malware payload (SnakeKeylogger)", "value": "a9a64f1234b5d76093debf58321bbda3cd65afc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628559790, "uuid": "e5494dc5-38fa-44a0-adb6-b6cc10bcafe7", "comment": "Malware payload (SnakeKeylogger)", "value": "2cdf1b5cf10f3d7a32a49f9517fd969d986112a12aa9e6aa61cc990ddef4c6bf8a57efb854d595d9a4848e4e941d4f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628559790, "uuid": "c1320c34-7592-4a0d-9d90-c6b938c60596", "value": "T156B45D97B223446DF9753937A86B143141A13EFB257AD3DE0B23BB636BF3A60A013445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628559790, "uuid": "d3a1360d-8752-44cc-b7ee-031006c1214a", "value": "f6b61b8e7cfb6c1ac49476384f4084e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628559790, "uuid": "611c8e9d-3bc7-4ae6-8d7b-5838336835e8", "value": "6144:KKMh/NAJK9Rh46uqsV50zthWFhFqY0shl8qYO04:KKMhvsV0zt4t0myqYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628559790, "uuid": "5cbf3a63-189d-443b-bcca-ea090e7f1248", "value": 496264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628559790, "uuid": "5550118e-893c-4d26-a4a9-2074adeda70a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628559790, "uuid": "efd19bdf-7427-4778-97d0-9a74e6f9f435", "value": "SecuriteInfo.com.W32.AIDetect.malware2.615.26676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d43e06-f9d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628596299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596299, "uuid": "f36990b2-626d-46e2-bef2-3ef8750354e2", "comment": "Malware payload (Formbook)", "value": "53856ef65a441d2b51abdac520a0b3dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596299, "uuid": "e631f662-c40e-432d-ac62-8889c9aa0762", "comment": "Malware payload (Formbook)", "value": "f79e63a900f1686efb6938afab99d2df64b390be52d8af9dc8da2aff14844981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596299, "uuid": "bff47d4f-c252-432a-8dfa-973ebf4df88d", "comment": "Malware payload (Formbook)", "value": "95a65b23785b52e04c109cfccef0ae1bc71c6455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628596299, "uuid": "83cf2898-328b-422a-80f5-f28c7931860f", "comment": "Malware payload (Formbook)", "value": "c16db05e350ebf7a96385fa81b7a97ead81fdc99f7f36bbdf22eebbae8cf918b5efed105fef26c374aa1dce1a8f0446b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596299, "uuid": "ed904c37-d925-407f-b7df-5c7574e861fa", "value": "T12605F0627780FB8EC17E4E75C451A940CBE0E3775303F7C72DE665EC4A8E6864A27286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596299, "uuid": "43080792-183d-465e-9c54-6a0dd3ab5e15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596299, "uuid": "7825dce9-be9f-4f70-95b9-414771f6fe7e", "value": "24576:UI9KocU3OHFWvkwrslP1jemRjnsrQfnxdOHF0P:UIkPYOlWkF1i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628596299, "uuid": "bfed1d1b-39c5-416a-afeb-4815a6fc8f3b", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628596299, "uuid": "2b280599-4b85-4975-8ebf-cd47fea9639f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628596299, "uuid": "7f6ec96e-2749-4dd6-807a-58acf8f76536", "value": "Orden de cotizaci\u00a2n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2190eaa-f9dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628601613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601613, "uuid": "b13ac489-7d9f-4081-8703-7d9332fbb850", "comment": "Malware payload (AgentTesla)", "value": "72739c8f8db3d24989a2e9b96ee83637", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601613, "uuid": "387b6f46-6027-4035-9d1e-f035f79d1332", "comment": "Malware payload (AgentTesla)", "value": "f7a9636f220abc8946c1ed8bf20195eb0d23badcca37af454aa625ccdecffab8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601613, "uuid": "0c8a4e3a-819e-4e94-b212-a0be4fcbb04e", "comment": "Malware payload (AgentTesla)", "value": "06c4d1a6e97cc2f168751011b4b7bc20888de124", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628601613, "uuid": "e3e6264f-7caa-4819-8b35-4b5d9c9af35f", "comment": "Malware payload (AgentTesla)", "value": "fe2890d88e4d33212489665a695743f5c3c87f33adfe3319bacdaa54236aca33495e455d5bf834cf65bc454d9813b421", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601613, "uuid": "5578fec2-3140-4b91-9645-c8d0da4dcbfc", "value": "T10915010727805393C41AAB3B589963530774FEE9DBA1EEE97882712E1DE6701CE43B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601613, "uuid": "673728b1-7147-49e5-834d-c7e73838e1ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601613, "uuid": "849f0edf-ca16-4535-b6eb-ea7ade71da41", "value": "12288:YhSKGn3qGaNHEyC9/oR9gy5FHK7zDxNWvRcgwnFhBqhElUuy5s/OFjXALScF5XND:YIKOPp9AR95yROcXhzLuAOFjOScnXND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628601613, "uuid": "0ac919ea-dc0a-434b-aa35-63aacbe58d3f", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628601613, "uuid": "0ae1ab87-86cd-44b0-87ba-221535b5418d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628601613, "uuid": "7238c92a-0197-4fe7-af40-daf7622e76a4", "value": "COPY OF PAYMENT USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ba7f24-f99d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628574084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574084, "uuid": "4fc69f69-b382-488e-a04e-c89b603799f4", "comment": "Malware payload (NetWire)", "value": "fe6b9636c6363b1cbcecd2b690408d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574084, "uuid": "d9ec4c49-0cee-4b09-a922-cde321ba79cf", "comment": "Malware payload (NetWire)", "value": "f7c37eac5808e804c64864a30eaa565b0cdf35b3738f049ac2e6f793f7603cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574084, "uuid": "fc502afc-69dc-478c-860d-3de6c517da39", "comment": "Malware payload (NetWire)", "value": "c1e7b86bb283116568211eeb200bb4eff457948c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574084, "uuid": "62477fb5-f2e4-49fb-a5a6-9f5ea32f9b3f", "comment": "Malware payload (NetWire)", "value": "1c855344b635fcc1d6b61311b10d0a1c75224278ab6e606c55066b35a2a0b374a84de568cffc78bcc84e5a4efb6ccdd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574084, "uuid": "c17d2319-42e2-47b9-af48-43afdb77e7aa", "value": "T1C4D459AC315075AFD637D873CA64AC10FEA024A7A307CE079153059B5E0EA53EE4DDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574084, "uuid": "4dd8f3d2-c442-48f9-b318-3e3053f035a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574084, "uuid": "01fd10f1-c5b1-402b-adad-0564694b0f1e", "value": "12288:mbdH+dbp3YjHGeBGLIdlvdGlRFKQQGoUvW5Vr5UjNaFkX2UHBNxrKU/Ia1SHKUpo:mbdyFyHGGFGF2GoU4Vr5QNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574084, "uuid": "226ed0af-6fe0-4a42-ae62-cf5bce6c18a9", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574084, "uuid": "aefd4f95-7f65-46b7-bf9e-b83eb59c9fa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574084, "uuid": "3903bdf6-9149-44c3-a146-a163707919d4", "value": "Paymentconfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e3f25f-f9a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628577705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577705, "uuid": "f8df6dcf-c278-4b5d-bd77-2b16cd5b66f4", "comment": "Malware payload (AgentTesla)", "value": "c35ac496552bf4da794678950ecbd774", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577705, "uuid": "cb8e2365-0a9d-4b58-9c71-d8a227d35d34", "comment": "Malware payload (AgentTesla)", "value": "f7ddebd53af8400592e1e907a850057d082658f7635519a8af8e3cd3d3ea0ca7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577705, "uuid": "d2a1b786-e0aa-43be-a7fe-ee41cdfdda1e", "comment": "Malware payload (AgentTesla)", "value": "851a961a68dd0c473952540dec8510cd998a57b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628577705, "uuid": "f8a94113-c34b-4367-a32d-f1b37d51be16", "comment": "Malware payload (AgentTesla)", "value": "65051f6e21f051d96c7374df9e48654d4303cc3294d5ffea70354adc32fb81d37595cbeb6b7e30030d9fe7abd908d55b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577705, "uuid": "aa04b260-e247-4925-b823-9bf52d36cc84", "value": "T173D423C5EB30AF8BA84588393549D265167E933ED0C93A01509933CBDFBC7B1609CBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577705, "uuid": "81ee0125-29bc-46b8-9416-b82acbda09ca", "value": "12288:JX3+Im51Svqpw/OWrN8fjwCXrNCgqBr6VKwwhyQVhWqt53qaR16oJoP4:Jn251HPW0j8AVR0yuhn57184", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628577705, "uuid": "033715c0-ff9a-4a47-8da1-b818dcdefb01", "value": 657091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628577705, "uuid": "5dbce8e4-3cb7-4908-b7a9-ce137f256e36", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628577705, "uuid": "384ba4c8-a20a-490e-82e8-03ce627bd96c", "value": "Int. Quote Inquiry Notice-Export req Bl+CI+Certificate of Origin.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419a851a-f9e7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1628605719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605719, "uuid": "3f1b0435-c9ee-4bda-9776-b6280246508e", "comment": "Malware payload (Alien)", "value": "757be08495745e8f90e97d33fa946aff", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605719, "uuid": "79426d6e-32e3-4b39-b026-941b89eded9f", "comment": "Malware payload (Alien)", "value": "f808d05653ae38eef70954a583c9cacdf5d43bd28e73e689174d47c73e431da6", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605719, "uuid": "4d8723cc-3547-4849-abeb-1536f641b691", "comment": "Malware payload (Alien)", "value": "0a7af3d293c4bc9fa142e714f5be6f774aa0a112", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605719, "uuid": "2138d94c-fb7c-4566-b8ac-715e54ceba42", "comment": "Malware payload (Alien)", "value": "690ec9146d1601a19d2894f2a34393396da29b37d77c668d8d50941330a229777600ca69538c44920dc845bbdc502dd8", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605719, "uuid": "da1a0941-0533-4028-9651-ba7cf0d374a9", "value": "T124C533767BE1DE1ECA5B0B71810B1A17FC391288CAC2BABF6275141458D2CA86F4DC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605719, "uuid": "0d7de061-ac0a-4ab8-80ed-3cb92e6e2643", "value": "49152:dDFzDxnFGJvAMs5oC/kW2njHqN1EdJue2NV3zBDb32XIFtPWs3Sn:JFzDxnU+5HylepBfGXNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605719, "uuid": "da1a611d-b7e2-4810-b95a-4c782ce87b10", "value": 2699718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605719, "uuid": "a0ff6c97-ec3c-440b-9483-d6793f568c06", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605719, "uuid": "e6e0e3ce-462e-4edd-a852-25b73ed57517", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca9ffb5-f9ef-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628609469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609469, "uuid": "ca1bcb0b-36e7-453e-8d03-f8e2bf848d01", "comment": "Malware payload (NetWire)", "value": "e6e30503815b9aeafe3d9947e89085ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609469, "uuid": "8da26091-4348-4e1d-90cf-59e10d97d3d6", "comment": "Malware payload (NetWire)", "value": "f830ad148cc49dcd705f421185850e5afe16f448a3f660600f9745be348d1d13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609469, "uuid": "13b5edae-c891-4335-b727-1e4ae4d7fe3b", "comment": "Malware payload (NetWire)", "value": "a9b664414179e6cac22e745bc179198a08b1b613", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628609469, "uuid": "df5bd8e7-1fa2-481a-a79e-0b53a1ed90b2", "comment": "Malware payload (NetWire)", "value": "e6cbd55ed0085ee8222b6acc69abc913a1644e3be1f0099744a701e862f7ae4f14231cb8b98f6c1cb0b35d547d907d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609469, "uuid": "8cc229aa-da36-441f-9868-d0353a917141", "value": "T1D6D4CE2F1544822BF57CD6BC69A8125FF228CFC3F1DDE896E8C73581C672A0625C469E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609469, "uuid": "4dc6299f-f1f4-4253-8c0a-49f8e964d170", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609469, "uuid": "a6143523-5ef1-4b0d-bed5-465373308a22", "value": "12288:5C2dIz2D7kUCOjiBsYYEE9R0DkJGaRFG3GdQCdhScU+gZR:5CWTqLsbE00DcG4FGudhSv5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628609469, "uuid": "2a851707-f064-43f9-920b-fd0810ac4abe", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628609469, "uuid": "17bf1b54-6f6e-4b19-a143-72fc596f4326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628609469, "uuid": "d8b619c0-ab91-462f-8d08-fbd53bd8a4bf", "value": "NIN-RFQ9357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d58cc2-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560794, "uuid": "208e8326-46e5-49c5-97b3-7a84528a8290", "comment": "Malware payload (Gafgyt)", "value": "2230164890c0fdc75f71b1adba2775a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560794, "uuid": "7d078059-ee18-4365-bfca-f7bde7df2cec", "comment": "Malware payload (Gafgyt)", "value": "f927c0bc38e173767409476620cf429121bffe78c8caef9f2d592e710806b473", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560794, "uuid": "55be28b8-9b9a-46cd-842e-0b3328ecefb0", "comment": "Malware payload (Gafgyt)", "value": "aef74501f784ed06a4b85b8bf84f1f1ec1eb566f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560794, "uuid": "43c11386-d778-4c05-aaae-52c8e26053b5", "comment": "Malware payload (Gafgyt)", "value": "8ec92b142c29edaf3c76f3f57f91ce17cd23da59ca5f251bffca45504a97ef94866a7b01a42d7913568d3166e8b6e94e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560794, "uuid": "cbaba87d-0adc-4975-b0d6-c1c1db6b5f0e", "value": "T1A3C3F82BBB270B23C0C6007116D71B32BEB5D3D935FA52976AE06DAC6F165843416FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560794, "uuid": "d44c246b-bfe4-424d-939d-b322fc32f529", "value": "3072:o3GN8mgKqz3FhTORcNcmKYFV/esFLfpZe:oW+Z7FhTORIcmKYFV/XFLfpZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560794, "uuid": "c0d9c3bf-25c8-4b59-88bc-d8fd003642a2", "value": 125918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560794, "uuid": "c14c8ec4-2086-43d9-8c3f-80b46bac48d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560794, "uuid": "d01c157d-2fe9-4727-b10f-80ce4d5271ed", "value": "2230164890c0fdc75f71b1adba2775a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50230b91-f9e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628603167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603167, "uuid": "cf6ab6a8-9ec4-40cb-84d2-9327a52a0149", "comment": "Malware payload (SnakeKeylogger)", "value": "840b567a9e2a4b9d9cc93ebb3d2e551e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603167, "uuid": "7455535c-c630-4efc-95c0-4cb084caf65c", "comment": "Malware payload (SnakeKeylogger)", "value": "f9c99819e882b21b76cf3397677ec58d55243ef1852c3105a3e324c4cf60dafd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603167, "uuid": "092aed38-aec8-4cbd-90ab-c2e7d3df43d0", "comment": "Malware payload (SnakeKeylogger)", "value": "2beb298cbf5c2e85ef0afce25610ecb9a3e07513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628603167, "uuid": "fa8e3d1d-d508-4bce-a472-3346973cf6f7", "comment": "Malware payload (SnakeKeylogger)", "value": "153ef0f8443dc922aec36f155041a17b764a8547de7a5c13b72e383ebe881e18244ec09d768c20ed16cb385da1553fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603167, "uuid": "a2a359ba-8566-4d0d-acd3-d5d9fe26b886", "value": "T1A2F4E0A57685FB8EC23B4EB9D9426900CBE0E637A607F3C73CE718DC164E2954623356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603167, "uuid": "20f81bb0-0c46-4358-961e-88476edbf5a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603167, "uuid": "88879531-f57b-432a-a323-e767baee5411", "value": "12288:AsUhjs1UvptQgVFyxzrt7uZVbqL6vFzDOFXiWxBkEryJF4W+vHVwamVDc4/9vopU:DkWmqgVF45ayinOFXpk/MReampc4/9v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628603167, "uuid": "c9b07ceb-254d-43b7-b543-11350936d0d3", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628603167, "uuid": "ea8c9e47-c556-430f-9ce6-e1ecaa9bd7a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628603167, "uuid": "cc118f5c-36eb-4968-b0f0-5e0e5293a3b4", "value": "840b567a9e2a4b9d9cc93ebb3d2e551e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e9a910-f9e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628605304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605304, "uuid": "f527bab8-c83a-4c11-b474-e3888dbd1be0", "comment": "Malware payload (Loki)", "value": "95b543d7b6fc8250e6d356f6c5797311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605304, "uuid": "c8c065de-d2c5-4642-9f1e-c01b865241e5", "comment": "Malware payload (Loki)", "value": "faa6f5e68119576f62ec4865fc4aecc2aa301560c33f508650b8aa6be54cf7dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605304, "uuid": "970e21e3-0fcd-456b-8aca-671a23afc402", "comment": "Malware payload (Loki)", "value": "b66f8a01bfffc396b0fd8e2136636de468663d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628605304, "uuid": "55e6b010-6632-4b5d-8fe3-895601a831d3", "comment": "Malware payload (Loki)", "value": "63f2e946fb1dcc1c657043aff9a5627c4068b317a682b58e1c66588e06ee324566ad7f9f67f74bdd8b9cfe6116c0265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605304, "uuid": "0010ef2b-6895-4f8c-b6d0-7effe67ea86b", "value": "T187F4BE25F227A748CCB8C3FB1858D1512BBABCE9721AD7382E54B0FC687363866D1711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605304, "uuid": "3fa0075f-53b1-42bc-98f3-8a75024656cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605304, "uuid": "41c61578-0270-482b-b5ab-c6cb1f7f7119", "value": "12288:XZNw59ZpcajN35p32OPZ82TMyEExBhFm/yaUVKnp:M5Lpca15zN0ExBj/ahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628605304, "uuid": "fecdc4b6-f142-4141-b655-124cdd54f130", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628605304, "uuid": "949dde28-45ff-48e5-8e6a-8bcb7e7f15f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628605304, "uuid": "f9984032-84f4-4314-a709-a76064f3b0b7", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985c21a8-f9f3-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628611019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611019, "uuid": "0f10e48a-66ef-4ffb-ae11-231201a939e0", "comment": "Malware payload", "value": "ca7aec7eacd0f2820c73bf0a9523a382", "object_relation": "md5", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611019, "uuid": "b57802f9-a176-4ed9-b4bb-29883c71a49a", "comment": "Malware payload", "value": "fb38636d1afb7c6df603ac4f441de7fd3d01c79c97577a5aca0afef8b2b8041b", "object_relation": "sha256", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611019, "uuid": "91b142df-ead4-4b46-a56e-663d1d7b11da", "comment": "Malware payload", "value": "c9eb3866d202582495c07abe5d8fcdf47e6c98d0", "object_relation": "sha1", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628611019, "uuid": "1857c95f-a943-4db3-a67e-f2a7518aed3b", "comment": "Malware payload", "value": "8227540d0b704ef3c0f2c88189fb84d08c52423ef3293ab35cda747316bedcb54ecaf319f0ad43c3e114b90d76f8c208", "object_relation": "sha3-384", "Tag": [ { "name": "alienbot", "colour": "#BCB255", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611019, "uuid": "aca591ff-95ed-4dbf-a2d3-f53408f74051", "value": "T1E5E5335977E3C24CC63BC73101076657363A20A91689F5BF71B900A3B4ABDD9D222DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611019, "uuid": "f903dbf1-9af6-48a5-9e61-ab1656d1fb3b", "value": "49152:rHJ/x3X4bGFT1ypsI9l8cxyvWdGHgNvewS2u6P6dlHq00b0J9d27jNP9aayTGgC:PI9sI4cwYHAh2P1QJ9yjZ9viGgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628611019, "uuid": "d304b2c8-90ac-4dc5-b94d-a50041649c21", "value": 3090749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628611019, "uuid": "aeb51b70-1ba7-4be0-ad5b-ef731bdb6582", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628611019, "uuid": "923ab40b-f870-4878-9ed8-85855516a173", "value": "Android-Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a020cbb4-f97e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1628560781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560781, "uuid": "2ade6fc1-91eb-483d-a709-6b6d541b0365", "comment": "Malware payload (Gafgyt)", "value": "efc23af2c7a3fd3fd868f612c23b28d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560781, "uuid": "a2dab46c-a18b-4e58-b561-28a8da81bbad", "comment": "Malware payload (Gafgyt)", "value": "fb5ed77644f91d2b91df69f29e2dc5805f4ab241958a5f9bfde4433ab95fce7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560781, "uuid": "f35ceff7-6e24-4b15-91f3-cefe93a4044f", "comment": "Malware payload (Gafgyt)", "value": "09801db0cc79a169005efeecf280c13d384c7e84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628560781, "uuid": "4643c21b-69f2-448c-9325-3054aecf23e9", "comment": "Malware payload (Gafgyt)", "value": "365b535f1d204af322f4bc21975cdf1b3bdfd6eb75fcbacc881ec296d2606af23323a07d179a688d961a2a7435b3c264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560781, "uuid": "af05a409-52b5-4cbd-ace4-1c7eae4018cf", "value": "T192A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560781, "uuid": "6e94442c-1625-4ef4-8363-2e8429cb6e85", "value": "3072:VSx+i6mqaObhN6nPNKV+qKmZuqQ4DPwXXtse:y6mRObn6nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628560781, "uuid": "f35ae054-1045-4f09-ac5c-5484eb6c75bf", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628560781, "uuid": "49e0fac1-d604-49e7-90c1-8b023db49df5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628560781, "uuid": "67a6ac76-f029-4c86-92cc-1bb0423508b0", "value": "efc23af2c7a3fd3fd868f612c23b28d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538581ba-f9b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628584275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584275, "uuid": "652982eb-6053-4812-bea5-328dcbe750f8", "comment": "Malware payload (AZORult)", "value": "98c1aa48f8b9ba8eacfeeef180ad7ba1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584275, "uuid": "f05627ab-5ef9-4cf2-aaf6-818326a82859", "comment": "Malware payload (AZORult)", "value": "fbff49100ec0523290c80ae279c0202540c1f5e939e39c571cfc09e46bc012b0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584275, "uuid": "39375bd5-e176-43ec-9e72-4d791c729123", "comment": "Malware payload (AZORult)", "value": "bc0f6809993f02457a873a6306caded55382745c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628584275, "uuid": "1addc90d-a586-4018-a3d9-07595b5d6647", "comment": "Malware payload (AZORult)", "value": "232a24454a6e07605ba3a68606c6afe5431fc05869488be5b183e0133d09905b1648d4cf2a04574a5881e61598ef4f2c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584275, "uuid": "ece20035-f2e6-4e9e-b1fd-59fe81cdcc87", "value": "T1D692CF1EA7C728B1C332AD3D88C841B6B51075895252C7AE4C08723EE786BCB174F1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584275, "uuid": "bda367a5-275b-4da4-b06b-02d12332cbd9", "value": "384:AKlLphZt2uedkiz0CM/ifi4l7Q2hGFF5gh3QITMaTA2:AKlFhZk5SiACsifNJhG352gIg32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628584275, "uuid": "5ad1c138-6bbd-48ac-a30d-a3ed234223eb", "value": 20488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628584275, "uuid": "7f1c7009-81b4-4ac0-80ac-bf739d73f906", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628584275, "uuid": "1e64fb98-daee-4c65-a98e-cf6c8fdd69c9", "value": "14035151501.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f1e1b8-f99e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628574538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574538, "uuid": "56fe7334-8d69-498d-82b9-3c880a792e3f", "comment": "Malware payload (AgentTesla)", "value": "7a3078f22e1ac3aaf5f8c44b2956f5c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574538, "uuid": "2ee26d1a-57a5-46b1-ac65-0d7d76af6efa", "comment": "Malware payload (AgentTesla)", "value": "fcf2392e4f6cff50cca5aa9d3cfa76da02eabc86a698758f5bee49ec4ffe2620", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574538, "uuid": "430804f7-c8c2-4c38-835e-fd4272851d50", "comment": "Malware payload (AgentTesla)", "value": "ea035e834a56c5ec504e46dd1f0653640b41609a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628574538, "uuid": "bad970da-7796-4df2-930d-13391716876a", "comment": "Malware payload (AgentTesla)", "value": "802312c1f2510a02d4e12ceb5b5e2cfb959a6532287a6d1857e1b196d09e1c69a6db7dec1175bfdfd84a0fc50fcc1b89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574538, "uuid": "7c52cef8-2b3d-4eca-8e0b-3bab8845733f", "value": "T10B05CFE16784C665E86B67398476A59323F3B20EDE69C90D2CC1BE5F3D333414063A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574538, "uuid": "782e27ea-28d5-4310-b31b-6e998eeccd77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574538, "uuid": "1fb8e5c3-1492-46f1-a331-039fa0550ce9", "value": "24576:WvS1bWMCx6jtJfoxeSTQZyGlh3zjcUfA:WvSxWd4gxeSTkh3zYYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628574538, "uuid": "a17ff9f4-e851-44eb-bbf9-acaa325a7004", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628574538, "uuid": "42562f09-2137-4c48-945c-720783d2df89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628574538, "uuid": "c77e1702-6149-4e7e-b462-0b7a1f661d4f", "value": "Int. Quote Inquiry Notice-Export req Bl+CI+Certificate of Origin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09366562-fa05-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628618510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618510, "uuid": "37484e77-302c-4cf9-aeb4-f6f2f0835261", "comment": "Malware payload (Mirai)", "value": "1a26792a95c172ede4bb6792579055ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618510, "uuid": "f77c9832-86aa-4c88-911f-ea12fa50a902", "comment": "Malware payload (Mirai)", "value": "fd4bed60a2bfa008595928e5cc8087fea3514e0d5f6c241a8257e6f8dac13ef5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618510, "uuid": "47808ba8-5f6d-45e5-ba71-1ec6ab7b4cab", "comment": "Malware payload (Mirai)", "value": "1710e6cdc79a3eacb98dcf22fe246e4e12748ee3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628618510, "uuid": "5ce63720-1cbc-4a02-ac4b-8b1839a8c087", "comment": "Malware payload (Mirai)", "value": "cddfd7c88d90f631888b4e9466431959969f26562436dceb8297f0aad33204a86d611918d831ff76fc99081a4fd1f3b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618510, "uuid": "a2963b66-6030-477b-9911-b26e2fdcd090", "value": "T162836C02B71C0943E1A61EF03A3F2BE1D36FEAA111E6B185690EDE85C171E335597ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618510, "uuid": "7ea6fb5b-2a4d-42fa-998b-f69f7fec6c01", "value": "1536:MPCTwNePJZZdVe1xMMbYA6WlrZ3Z8KE75hos:MPwnSLLYQL3+5hos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628618510, "uuid": "63fd9a76-dc60-4814-9bc8-a16148efe1b2", "value": 83420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628618510, "uuid": "f6bafae4-ce14-4607-93f8-c1d965dd8ce3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628618510, "uuid": "a0fdd0d0-4ec6-4468-a1df-2f92d69f44bc", "value": "1a26792a95c172ede4bb6792579055ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3ba500-f9ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628586469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586469, "uuid": "9b31143c-a2fa-439f-bb70-50ca73e4852b", "comment": "Malware payload", "value": "3db33d31ceefc6754b36407c087f1f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586469, "uuid": "5e872344-fd6e-42aa-9f0b-9ee52a7417e9", "comment": "Malware payload", "value": "fe23bd867820b26b03a912df04288f2de4d7bc331cbaba2a19dd4d60d0cdb556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586469, "uuid": "1aa652ae-7748-466f-bce8-9f59f043276d", "comment": "Malware payload", "value": "43f0bbc9fc906111ed157f886ac0dcf67063fbf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628586469, "uuid": "6482e7aa-e2c8-4444-ae79-b1d3d3aff19f", "comment": "Malware payload", "value": "cafe2272e8175299493d1c99c08a2adc6d287d942ff92aaa7474f8df0b6f1e9f9593d544f8071a01e8ee3365c229f2bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586469, "uuid": "0bb21a82-c5eb-4ced-81be-1d36538b2782", "value": "T101E49EA0B9E05837C22217B56C2B86699825FE053924758676EEFD7C8F3B3C2381D1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586469, "uuid": "d0f7f261-3f79-4e39-99c8-0a69013de5f6", "value": "8334ffffda06cacb2b113ba9de8c078a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586469, "uuid": "e8812759-a6dc-4b6c-8c8c-80db551c7e79", "value": "12288:mDPmOzS2AO+GBDfNj/nNImvYGU3F4JDW6xpYMeAEmGQPN+BRKa:0eJ2Aq9p/nWmwG845W6xKMe2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628586469, "uuid": "236c859e-7eef-4cf6-b053-815bbd9c07da", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628586469, "uuid": "3ac25077-b5d7-41ea-aaec-f0ac42e2c579", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628586469, "uuid": "9838d2fe-9a65-4609-b889-731ac3e299b7", "value": "URGENT PO OFF00272307 - AMS,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d76f51-f9db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628600708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600708, "uuid": "cf771e00-c054-4049-a806-462b3fb97233", "comment": "Malware payload (SnakeKeylogger)", "value": "465e98c8328e91af49b7c5bf8b9ad3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600708, "uuid": "ddd764d6-06bc-4432-afb0-e7f59f4b8077", "comment": "Malware payload (SnakeKeylogger)", "value": "fe7933b0f7dde64587b0bbdaa5e4728066c4eb56edab2ee863ad94cf52b0391f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600708, "uuid": "5c988cbe-3981-45f7-93b2-78fdd5f5ece5", "comment": "Malware payload (SnakeKeylogger)", "value": "e3587055e8af54ec7fc1efbb4d8d75e8dc7d6b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628600708, "uuid": "d0d9f2f4-9e2e-4032-9709-185d4fd8e9d9", "comment": "Malware payload (SnakeKeylogger)", "value": "290b0980557ad75ad91628245a3f4265a6ba8aa1779cc6385fd8b84942db06d78591d0074f11685d2263f6bbf1b68596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600708, "uuid": "374ab65b-3fd5-4212-a5f5-afeb721cd31d", "value": "T1B905024B23804393C805AB371899639307B4EED5DBA1EDA87D85392E1DFB741CE52B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600708, "uuid": "a95e083a-65fb-4cac-a23e-caeb33996622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600708, "uuid": "69160637-f72e-4b65-b6d2-b88ae80ea165", "value": "12288:3TKAn3qGaNHEyC9/oR9gy5FHK7zauReV6nDO5qcy2HnbDQK71hOnZDRfKHgXDjy:3TKAPp9AR95ymuPhsvOLKHgXDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628600708, "uuid": "9a433d88-2490-4075-a43d-072390e1efea", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628600708, "uuid": "a0501abc-49a7-40dc-a0e0-cce688c1e41b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628600708, "uuid": "d3436863-8a6c-42cf-9435-7bb055566431", "value": "PO IN-2108,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }